Detect and redact secrets, API keys and tokens

What counts as a secret?

The SECRET label covers machine credentials: strings that grant access to a system. These are not personal data like names or emails. They are keys, tokens and passwords that should never sit in plain text.

Sanitext tags these as SECRET because the action is the same as for any other PII: find it, then mask it before the text is stored, shipped or sent to a third party.

• —API keys (Stripe pf_live_, OpenAI sk-, AWS AKIA, Google AIza, SendGrid SG.)
• —Bearer tokens and OAuth access tokens in Authorization headers
• —JSON Web Tokens (JWTs) with the three base64 parts
• —Private keys (PEM blocks, SSH keys) and connection strings with passwords
• —Generic high-entropy secrets and passwords in key=value or env-var form

How does secret detection work?

Send text to POST /v1/detect. Sanitext returns a list of spans. Each span has a label of SECRET, a start and end byte offset into your input, a confidence score between 0 and 1, and the exact text that matched.

Offsets are byte offsets, not character counts, so multibyte input lines up correctly. You can use the offsets to highlight, slice or replace each secret yourself, or call POST /v1/redact to get the text back with every SECRET swapped for [SECRET].

The model runs on our own Cloudflare infrastructure. Your text is not sent to any third-party LLM, and we keep no raw text. We log counts and timings only.

Edge cases and formats

Secrets are tricky because formats vary and look-alikes are common. Sanitext leans on known vendor prefixes plus entropy, so a Stripe pf_live_ key or an AWS AKIA id scores high, while a random long word scores lower.

Detection is best-effort. A brand-new vendor format with no recognizable prefix may be missed, and a high-entropy product code or hash can be flagged by mistake. Use the score to set a threshold that fits your risk level, and treat output as an aid, not a guarantee.

• —Truncated or redacted-looking keys (pf_live_***) may score low or be skipped
• —Tokens split across lines or wrapped in quotes are still matched by content
• —A leaked password in plain prose is harder to catch than a key=value pair
• —SECRET is for credentials; an email or phone gets its own EMAIL or PHONE label

Does it work in other languages?

Secrets are language-agnostic. An API key looks the same in a Spanish log line as in an English one, so the SECRET label works across all 30+ languages Sanitext supports.

The surrounding text (the label, the comment, the error message) can be in any language. One multilingual model handles SECRET alongside FIRSTNAME, EMAIL, PHONE and the rest in a single call, so you do not pick a language up front.

FAQ