Redact server logs before you ask an AI to debug them
Logs are the most-pasted text in engineering and the least-reviewed. A single request line can carry a customer email, a bearer token, an internal hostname, a session ID and the IP address of a real person — none of which the model needs to tell you why the request 500ed.
This preset keeps timestamps, status codes, paths and stack frames, and replaces IPs, MAC addresses, emails, tokens, keys and labelled identifiers with placeholders.
Your text
Safe to paste
Preset: addresses, tokens, emails and identifiers out — timestamps and stack frames kept.
Mapping — 0 values (only visible in this tab)
| Placeholder | Real value | Uses |
|---|
Check a few rows before you paste — this is the fastest way to spot a detector that grabbed the wrong thing. Nothing here is stored or sent anywhere.
What to look for — 30 detectors, custom terms, exceptions
People & organisations
Government & health IDs
Financial
Technical & secrets
Location
Step 3 — paste the AI’s answer here to put the real values back
The model replies using the placeholders. Paste its answer below and every
[NAME_1] becomes the real name again — using the mapping held in this tab, which
is the only copy that exists.
How it works
- Open this page — the detectors are already set for “Server logs”.
- Paste your text, or drop a .txt, .md, .csv, .json or .log file onto the panel.
- Check the highlights: every match is coloured by type, and one click keeps a type as-is.
- Copy the safe version and paste it into the AI tool of your choice.
- Paste the model’s reply back into step 3 to restore the real values.
What is actually identifying in a log line
IP addresses are personal data under EU law and treated as identifiers under HIPAA Safe Harbor; they are also the field engineers assume is harmless. Session and request IDs are pseudonymous but link back to a person through your own systems. Bearer tokens are worse than they look, because a JWT payload is base64-encoded, not encrypted — anyone who reads the line can decode the subject, the email and the organisation it was issued for.
The useful debugging content is elsewhere: the timestamps, the ordering, the status codes, the path, the exception and the line number. Those all survive the scrub untouched, which is why a scrubbed log still gets you the same answer.
Keeping the log readable
Placeholders are stable, so [IP_1] is the same host on line 1 and line 40. That preserves the pattern you were probably looking for — the same client retrying, two different clients hitting the same endpoint, one device generating every error.
Names and free-text detectors are off here on purpose. Log lines are full of capitalised tokens (RefundService, NullPointerException, GET) and a name detector tuned for prose would make a mess of them.
Tips
- Paste a window around the failure, not the whole file: 30 lines usually beats 3,000 for answer quality.
- If your logs contain query strings with tokens, switch URLs on — off is the default because the path is usually the clue.
- Rotate any token that has already been pasted somewhere, then fix the logger that printed it.
Detectors are pattern-based and imperfect: read the highlighted output before you paste it anywhere, and confirm your own confidentiality obligations against the current rules for your profession, employer or jurisdiction. Compiled 2026-07-29.
Frequently asked questions
Why replace IPs at all — they are not secret?
An IP address identifies a subscriber in practice, which is why the EU treats it as personal data and HIPAA lists it among the Safe Harbor identifiers. Replacing it costs nothing for debugging, since what matters is that two lines share an IP, not which IP it is.
Can it handle a 10 MB log file?
Files opened from disk are capped at 5 MB, and above roughly 120,000 characters the colour highlighting turns off to keep typing responsive while the scrub keeps running. For bigger files, grep the interesting window first — you will get better answers anyway.
Does it decode JWTs to check what is inside?
No. It matches the three-part structure and replaces the whole token. Decoding would mean parsing your credentials, which is unnecessary — the right action for a token in a log is to replace it here and rotate it upstream.