API Key & Secret Masking Formatter

Paste an API key or secret to get a masked version that is safe to share, a ready-made .env line, and the right way to read it from code — so the real value never ends up hardcoded. Below, convert every secret in a block of code or config in one go.

API key or secret (NAME=VALUE is also accepted)

Environment variable name

⚠️ Whatever you type is processed only in your browser and is never sent to a server. Even so, press “Clear now” or close the page when you are done. The single-secret field above also clears itself 60 seconds after your last keystroke.

Enter a key or secret on the left to see the converted output here.

Convert many secrets at once (code and config)

Paste code or a config file that contains several secrets — for example, output from an AI coding assistant. Values are found by the variable name (key, secret, token, password, pwd, credential, auth) or by well-known key formats, and converted by the rule you pick.

Text to convert

Replace with a partial mask Replace with an environment variable placeholder (${VAR_NAME})

⚠️ This box does not clear itself. Press “Clear” or close the page when you are done.

Before and after

About this tool

Secrets pasted into chats, tickets, screenshots and AI prompts are one of the commonest ways keys leak. This tool helps you share a recognizable but unusable version of a secret, move the real value into a .env file, and replace it in code with a reference to an environment variable.

Everything happens in your browser, and nothing you enter is sent to a server. A masked value is a hint, not encryption: if you ever pasted the real key anywhere it should not be, revoke it and create a new one.

How it works

Single secret: paste a bare value, or a line such as OPENAI_API_KEY=sk-… or token: abc…, and the variable name and value are separated (surrounding quotes are removed). A name you type in the variable-name box takes priority and stops being overwritten.
Provider detection suggests a variable name from the prefix: sk-ant- Anthropic, sk- OpenAI, sk_live_/rk_live_ Stripe, AKIA AWS access key ID, github_pat_ and ghp_/gho_/ghu_/ghs_/ghr_ GitHub, xoxb-/xoxp- Slack, AIza Google, SG. SendGrid, hf_ Hugging Face and xai- xAI. Anything else becomes API_KEY. The name is cleaned so that it only has letters, digits and underscores and does not start with a digit.
Output: a masked version, a NAME=value line (shown masked until you tick “Show the value”), copy-ready reference snippets for Node.js, Python, PHP, Go, Ruby, Java, .NET, GitHub Actions, Docker Compose and the shell, and the .env line for .gitignore. Only the masked text and the .env line contain the secret, and only the .env copy button copies the real value.
Auto-clear: the single-secret field and its variable name are cleared 60 seconds after the last keystroke. The bulk box is not cleared automatically.
Bulk conversion: for each line, if it looks like [export|const|let|var] name = "value" (or name: value) and the name contains key, secret, token, password, pwd, credential or auth, or the value has a known key format, the value is replaced. Other lines are scanned for known key formats anywhere in the line, such as a token inside a header. Lines that do not match are left unchanged. Names are not matched inside quotes or across lines.
Bulk rules: a partial mask (same rule as above), or ${VAR_NAME} using the provider’s standard name when the format is known, otherwise the variable’s own name in capitals, otherwise SECRET_VALUE.
The detector is pattern based. It can miss a secret with an unusual name or format, and it can convert a value that is not secret, so read the before and after view before you copy the result.

FAQ

Q. Is a masked key safe to post publicly?

A. It is much safer than the real key, but the visible first and last characters still narrow down what the key is. For a short or low-entropy secret, hide more or share nothing. Never post a real key and rely on the mask alone afterwards.

Q. Should I commit the .env file?

A. No. Keep .env out of version control (that is what the .gitignore line is for) and commit an example file such as .env.example with placeholder values instead.

Q. Why not just paste the key into my AI assistant?

A. Prompts, tool calls and logs can retain what you send. Mask the secret first, or give the assistant a reference such as ${VAR_NAME} and keep the real value in the environment.