String Masker
Mask the middle of API keys, tokens, card numbers and other PII — keep the first and last few characters, redact the rest, a whole list at once. No upload.
🔒 Masked in your browser — your secrets are never uploaded.
What String Masker does
Paste any secret or piece of personal data — an API key, access token, credit-card number, email address, or phone number — and this tool hides the middle while leaving the first and last few characters visible. That keeps the value recognizable enough to reference in a bug report, screenshot, or support ticket without exposing the sensitive part. Set exactly how many characters to keep at the start and end, choose a mask character (a bullet •, an asterisk *, or the letter x), and mask a whole list at once with one secret per line.
Built to never leak a short value
If the characters you ask to keep would cover the entire string — for example keeping four at each end of a six-character value — there is no real middle left to hide, so String Masker masks the whole value instead of revealing it. Every character is counted by code point, so accented letters and emoji are never split apart. Everything runs locally in your browser with JavaScript, so your secrets are never uploaded, logged, or stored. To scramble text so it can be reversed with a key instead of redacted for display, use the text encrypt tool or the cipher.
Frequently asked questions
Does masking hide enough to share a secret safely?
It hides the middle, which is usually the sensitive part, while leaving a few characters at each end so you can still tell which key or value you mean. For maximum safety keep fewer characters, or set keep-first and keep-last to 0 to hide the value completely.
What happens if a value is shorter than the characters I keep?
The whole value is masked. When the kept prefix and suffix would meet or overlap there is no distinct middle to hide, so revealing both ends would expose the entire secret — the tool masks everything instead.
Are my secrets uploaded anywhere?
No. All masking runs in your browser with JavaScript. Your input is never sent to a server, logged, or stored, so even production keys and personal data stay on your device.