Incident Response · AWS AKIA / STS · Bearer JWT · PEM Private Keys

Redact JWTs, AWS Keys & Auth Headers from Logs — 100% Client-Side

Sharing production CloudWatch, Datadog, Nginx, or Kubernetes pod logs in a GitHub Issue, vendor support ticket, Slack channel, or LLM prompt? One stray Authorization: Bearer eyJhbG... or AKIA... session key can hijack live accounts. Scrub multi-thousand-line logs locally in milliseconds.

Open Offline Log & JWT Redactor →

🔒 100% Client-Side Browser Privacy · Detects JWTs, AWS/GCP/Azure Keys, Slack/GitHub Webhooks, DB Strings & Private Keys in RAM

中文提示：线上故障排查 (On-Call / Incident Response) 往工单、GitHub Issue、外包供应商群或 AI 粘贴报错日志与 Copy as cURL 前必过一遍！纯本地识别脱敏 Bearer eyJ... JWT 令牌、AWS AKIA 密钥、Azure 连接串及私钥块，保持合法 JSON 结构不破坏上下文。

High-Risk Cloud & Auth Credential Signatures Automatically Scrubbed

Credential Class	Signature / Entropy Pattern	Sanitized Output Token
JSON Web Tokens (JWT / OIDC)	`eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+`	`<JWT_TOKEN_1>`
AWS IAM & STS Access Keys	`AKIA[0-9A-Z]{16}` / `ASIA[0-9A-Z]{16}` + 40-char Secret	`<AWS_ACCESS_KEY_1>` / `<AWS_SECRET_1>`
Azure Storage / SAS & Connection Strings	`AccountKey=...;` / `sv=2022-...&sig=...`	`<AZURE_CREDENTIAL_1>`
PEM / SSH Private Key Blocks	`-----BEGIN (RSA\|EC\|OPENSSH\|PRIVATE) KEY-----`	`<PRIVATE_KEY_BLOCK_1>`
RFC1918 & Internal Corp Hostnames	`10.x.x.x`, `172.16-31.x.x`, `*.internal.corp`	`<INTERNAL_IP_1>` / `<CORP_HOST_1>`

Why JWTs in 'har' Files & Debug Logs Are Live Session Bombs

JWT Payloads Are Base64Url — NOT Encrypted! Anyone reading an unredacted eyJ... token in a Jira/GitHub comment can base64-decode user emails, tenant UUIDs, and role claims in 2 seconds — and replay the bearer token until exp!
HAR File & cURL Warning: Browser 'Copy as cURL' and exported .har captures embed Cookie:, x-api-key:, and Authorization: headers verbatim. Always run Copy as cURL snippets through PasteShield before sending to third-party support or AI!
Consistent Request-Correlation: Distinct JWTs become <JWT_TOKEN_1> and <JWT_TOKEN_2>, so you can still trace multi-user race conditions across 500 log lines!

Sanitize Stack Traces & cURL Reproductions Before Sharing

Open the Offline Log Redactor Playground above in any modern browser.
Paste raw Kubernetes logs, Copy as cURL commands, or JSON webhook payloads into the input pane.
Verify the Vault Counter pill showing how many JWTs, cloud keys, and internal IPs were caught and indexed.
Copy the scrubbed output safely into GitHub Issues, Zendesk vendor tickets, Slack channels, or AI chat assistants!

Common Regex Blind Spots in DIY `sed` Scripts

Missing URL-encoded or multi-line secrets: Quick sed one-liners miss postgres://user:p%40ss@... credentials, base64 Basic Auth headers, and multi-line -----BEGIN PRIVATE KEY----- blocks.
Destroying JSON validity during redaction: PasteShield replaces secret values inside string literals cleanly without breaking surrounding JSON quotes or braces!

Frequently Asked Questions

Does redacting inside JSON payloads keep the JSON valid and parseable?

Yes! PasteShield substitutes the secret token inside quotes (e.g. "token": "<JWT_TOKEN_1>") so JSON formatters, linters, and LLMs still parse the structure cleanly.

Why shouldn't I paste even an 'expired' JWT into public issues or AI prompts?

Even expired JWT headers and payloads expose internal user IDs, email addresses, org/tenant IDs, issuer URLs, and key IDs (kid) in plaintext Base64Url.

Can I install this directly inside VS Code or Cursor so I don't even switch tabs?

Yes — PasteShield is available as a lightweight, zero-dependency extension for VS Code and Cursor with instant keyboard shortcuts.