Sharing configuration is routine — a support ticket, a runbook, a debugging session, documentation. Sharing the values in it is not.
This masks many values at once, one per line, which is the shape configuration actually arrives in.
What survives masking
The prefix. sk_live_ tells the reader which provider and environment without disclosing anything — prefixes are public and carry no entropy.
Four characters at each end. Enough to answer "is this the same key as the one in production?" while leaving the search space essentially untouched.
The length, as a count. [18 chars] rather than an exact-width run of asterisks, because an exact length narrows an attacker's search.
Eight characters is the ceiling
Each revealed character of a Base62 key removes about 6 bits from the attacker's problem. Eight revealed characters is roughly 48 bits gone. On a 128-bit key that leaves 80, which is still substantial; twelve revealed characters leaves 56, which is not.
The tool flags anything above eight, because the temptation is always to reveal a little more for readability.
What masking cannot fix
Masking helps at the moment of disclosure. It does nothing about the copy that already leaked.
If a value has been in a screenshot, a chat message, a ticket attachment or a git commit, it is compromised. Rotate it. The revocation generator has the commands, and the blast radius analyzer helps you decide how urgently.
Redaction in your logging layer
Doing this by hand is a mitigation, not a solution. Application logs should never receive credentials in the first place:
- Add a redaction filter to your logging library, keyed on field name patterns like
key,token,secret,password. - Never log entire request headers or configuration objects — that is how credentials reach logs even when nobody logs them deliberately.
- Log a key's database identifier or a truncated hash, never any part of the value.
Redaction filters fail exactly when a new code path forgets to use them, which is why not logging the value at all is the real fix.
Frequently asked questions
Can I redact a whole .env file?
Paste the values, one per line, rather than the whole KEY=value lines. Masking a full assignment line would obscure the variable names too, which are usually the part you want to keep.
Is the masked output safe to post publicly?
With four and four, yes. The remaining search space is essentially the full key. Consider whether you need to post it at all — a fingerprint from the key detector identifies a key without revealing any characters.
Why is preserving length discouraged?
An exact length tells an attacker the encoding and the byte count, which narrows the search. The character-count form conveys "this is a long value" without that precision.
What about values with no prefix?
They are masked the same way, first four and last four. Without a prefix there is less identifying information, so consider including the variable name alongside the masked value.