Skip to content
ModshelfSubmit

Secret Redactor

Swaps keys, emails and IP addresses for placeholders before Claude reads them

Safety and privacyPop-up notesIn the transcriptDraws only
Secret Redactor running in Claude Code

Recorded on Claude Code 2.1.287 in a sandbox. Claude's replies are scripted; everything the mod draws is real.

What it does

When a secret shows up in your session, Claude gets a placeholder like [REDACTED-SECRET-164d0c98] instead of the value. That covers keys you paste into the prompt, anything a tool reads back (a cat .env, a config file, an API answer) and secrets in the CLAUDE.md files loaded at the start. The same value always gets the same placeholder, so Claude can still tell two keys apart. When Claude passes a placeholder to a tool, the real value goes back in, so commands and file writes still work.

How to use it

Install it and work as usual. When you paste a key, a note in the top right says how many values it hid from the prompt.

It hides three kinds of value:

  • Secrets: known key shapes (sk-ant-, ghp_, AKIA, sk_live_, JWTs, private key blocks, the password in a postgres:// URL), long random-looking tokens, and shorter ones that follow a name like API_KEY= or Bearer.
  • Email addresses, except obvious placeholders like noreply@ or @example.com.
  • Public IP addresses. Private ranges such as 127.0.0.1 and 192.168.x stay visible unless you turn on redactPrivateIps.

The options (turn emails and IPs off, change the entropy thresholds, never hide certain strings) go under pluginConfigs in your user settings.

Good to know

  • The real values live in memory for the session only. Nothing is written to disk, and placeholders mean nothing after a restart.
  • Public ids like Stripe's price_ and prod_ are left alone, and so are word-like names and bare hex strings such as git hashes (unless a name like API_KEY= sits in front).
  • It doesn't hide a secret Claude writes itself, only what Claude reads.
  • The README still says to set CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1. On Claude Code 2.1.287 mods load without it.