How to strip API keys and passwords from code before pasting it into an AI

You have a config file, a .env, or a slice of a log, and you want to paste it into ChatGPT or Claude to get help with a bug. Somewhere in that text sits a database password, an API key, or a bearer token, and the moment you paste it, that value has left your machine. This page shows the manual way to find those values, hide them before you paste, and put the real ones back afterward. It works, it needs no tool at all, and once you have done it a few times it takes only a few minutes.

The manual method

Work in a plain text editor, not the chat window itself, so you can read the whole thing calmly before it goes anywhere.

1. Read the file once from top to bottom before changing anything. Note every line that assigns a value to a name ending in KEY, SECRET, TOKEN, PASSWORD or AUTH: those are almost always the values that must not travel.
2. In a database connection string such as postgres://app:MyPass1@db.internal:5432/app, only the password segment needs hiding. The username, the host, the port and the database name are structure the assistant needs to reason about the bug, and they can safely stay.
3. Check curl commands and request logs for an Authorization: Bearer header or a Cookie header. The token after Bearer is a secret; the header name itself is not.
4. Look for a whole PEM block, the lines running from -----BEGIN PRIVATE KEY----- to -----END PRIVATE KEY-----. Hide the entire block as one unit rather than trying to shorten it.
5. Replace each value you found with a short placeholder in square brackets, such as [DB_PASSWORD_1] or [STRIPE_KEY_1]. Use the same placeholder every time the same real value repeats, so a token set once in a .env file and sent again in a header reads as one secret, not two.
6. Keep a plain-text scratch note, on paper or in a second file you never paste anywhere, mapping each placeholder back to its real value.
7. Before you send anything, read the masked text once more, hunting specifically for a value that looks random but carries no obvious name next to it. That is the case the earlier steps do not catch.
8. When the reply comes back, open your scratch note and substitute each placeholder for its real value by hand, one at a time, checking as you go.

Cost in time: a short config of twenty to thirty lines takes about three to five minutes done carefully. A long log file running to hundreds of lines, especially one with a repeated stack trace, can take twenty minutes or more, because every repeat of the same secret needs the same placeholder and a repeat is easy to miss on a fast read.

Where this goes wrong

• A value gets missed because it has no recognisable shape: a plain random string sitting under a name like INTERNAL_TOKEN that does not obviously say "secret".
• The same secret gets written two ways, once as an environment variable and once pasted inline in a curl example, and ends up hidden behind two different placeholders for one real value, so the restore step puts the wrong thing back in one of the two spots.
• Two placeholders that look alike, such as [KEY_1] and [KEY_2], get swapped during the manual restore, and the wrong key lands in the wrong place.
• Skipping the final read-through because you are in a hurry, which is exactly when it matters most: the file you are debugging at speed under pressure is usually the one with the real secret sitting in it.

The one-step way

Keyback runs the same steps in one pass, in your own browser tab, with nothing installed and no account. Paste the text, press Strip secrets, read what comes back, send that to the AI, then paste its reply back in to restore the real values. Try the free version for anything under 2,000 characters a pass, or visit the product page to buy the file, 19.00 USD personal, 79.00 USD team, one purchase, no subscription. A company that wants every desk covered can take the Source and Intranet Licence, all six tools with their source, one purchase.

Detection, by hand or with Keyback, is pattern based. Review the output before you send it, every time.