RunLocalTools

Log Anonymizer & Noise Filter — Redact Logs Online Without Uploading Them

Filter noise out of log files and strip emails, IPs, tokens and secrets before you share them. Consistent tokens, reversible, 100% in your browser.

What it does

You drop in one or more log files (.log, .txt, or gzip-compressed .gz) — or paste text — and the tool does two jobs in one pass. First it cuts the log down to the records that matter: health-check spam, static-asset requests, bot traffic, repeated lines, everything below the level you care about. Then it anonymizes what is left, replacing emails, IP addresses, API keys, passwords, cookies, usernames, phone numbers, card numbers and more so the log can go into a support ticket, a bug report or a public forum without leaking anything.

The result is a smaller, safer file that is still debuggable, because the same original value always gets the same replacement. alice@example.com becomes EMAIL_1 every time it appears, in every file of the run, so you can still follow one user or one host through the whole log.

How it works

Records, not lines. The tool groups lines into records before it filters anything. A Java stack trace, a Python traceback or a wrapped JSON message stays attached to the line that started it, so removing a noisy record never leaves an orphaned at com.example.Foo.bar(...) behind. Timestamp-led logs, JSON-lines logs and plain line-per-record logs are detected automatically.

Levels from real signals. Severity is read from a JSON level field, logfmt level=, syslog priority, a leading [WARN]-style tag, and HTTP status codes in access logs (5xx counts as ERROR, 4xx as WARN), using the same level names as our Log Analyzer. Records with no detectable level are kept rather than guessed at.

Validated detectors, not just patterns. A 16-digit number is only treated as a card if its brand prefix and Luhn checksum are valid, an IBAN only if its mod-97 check passes, and an IPv4 address only if every octet is 0–255 with no leading zeros. That is why 1717232400000 (a timestamp) and 1.2.3.4.5 (a version string) are left alone while real card numbers and addresses are caught. IPv6 is validated properly, so std::vector and 12:34:56 are not mistaken for addresses.

Consistent replacement modes. For each category you choose how to replace values: a plain [REDACTED], a type label like [EMAIL], a consistent token like EMAIL_3, a salted HMAC-SHA-256 hash, a partial reveal like j***@example.com, or dropping the whole line. IP addresses have a fourth option that maps each real /24 subnet to a fake one, so two hosts on the same network still look like neighbours after anonymizing.

Format-aware. In JSON-lines logs the output is checked to still be valid JSON, and sensitive values are also matched by key name (password, email, user, token…). If a text-level replacement would ever break a line, the tool re-serializes it instead.

A leak check on the way out. After anonymizing, the output is scanned again with every detector and anything that still looks sensitive is reported, so you find out before you paste it anywhere.

How to use it

  1. Add your logs. Drag in one or more files (gzip works), or open “paste log text”. Several files in one run share the same replacement tokens.
  2. Filter (optional). On the Filter tab set a minimum level, tick the noise presets you want gone, add exclude or include rules (contains, starts-with or regex), pick a time range, or collapse repeated records. Include rules can keep a few records of context before and after each match.
  3. Choose what to anonymize. On the Anonymize tab leave the sensible defaults or change the replacement mode per category. Add custom terms (names, company and project codenames), custom regex rules, and an allowlist of values that must never change, such as 8.8.8.8 or *.yourcompany.com.
  4. Run it. Press “Filter & anonymize”. The Result tab shows how many records were kept and removed, why, what was replaced, the leak-check verdict, and a side-by-side preview with every replaced span highlighted.
  5. Save the result. Download the file (or a zip for a batch), copy it, or export the report as .txt or .json. The report contains counts and masked examples only, never original values.
  6. Restore originals later (optional). Save the reversal key before you close the tab. When someone replies about EMAIL_3 or 198.18.0.4, paste their text into the Restore tab and the originals come back.

What it detects

  • Secrets: private-key blocks, JSON Web Tokens, AWS, GitHub, Slack, Stripe, Google, GitLab, npm, SendGrid and OpenAI-style keys, Authorization headers, cookie values, password= / token= / secret= style values, and credentials embedded in URLs.
  • Identifiers: email addresses (including internationalised ones), IPv4 and IPv6 addresses, MAC addresses, phone numbers, hostnames in URLs and host= fields, and usernames in SSH and sudo lines, user= fields and home-directory paths.
  • Financial and personal: payment cards, IBANs, US Social Security numbers, name and address fields such as first_name= and street=.
  • Yours: any terms and regex rules you add.
  • Timestamps (optional): shift every timestamp by one constant offset, chosen randomly or by you, in ISO 8601, Apache and nginx, syslog and epoch formats. Order and intervals are preserved.

Limitations

  • Detection is pattern-based with validation. It cannot recognise a free-text personal name in the middle of a sentence; add known names under custom terms and rely on the leak check as a safety net. Always skim the result before sharing it.
  • UUIDs are left alone by default because they are usually correlation IDs, not personal data. Switch them on if yours identify people.
  • Bare hostnames like db01.example.com are only masked when they appear in URLs or host=-style fields, unless you enable the stricter option, which may over-match.
  • Files are read as UTF-8. Log files in other encodings may show replacement characters.
  • Very large logs work but take time. With every detector and the leak check on, expect roughly 2 MB per second on a typical machine, and the tool works in the background so the page stays responsive. You can cancel any time.
  • If a custom regex backtracks catastrophically, the run is stopped automatically after 20 seconds with a message, instead of freezing your browser.

Privacy

Everything on this page is local-only. Your files are read and processed inside your browser, in a background worker, and nothing is uploaded, fetched or sent anywhere. There are no optional online features, and this tool does not download any code libraries, so it works fully offline once the page has loaded. Files you add and your settings are kept in your browser’s own storage so a refresh doesn’t lose your work; the “Clear everything” button removes both. The reversal key file contains the original values, so treat it like the sensitive data it is.

FAQ

Is it safe to paste production logs into this tool?

Nothing you add leaves your browser: there is no upload step and no server that receives your text. You can check that yourself by opening your browser’s network tab while you run it. The only thing that persists is a copy of your files and settings in your own browser storage, which you can wipe with “Clear everything”.

Will the anonymized log still be useful for debugging?

Yes, that is the point of consistent tokens. The same email, IP or username always maps to the same label, so you can still trace one user through a session or see that two errors came from the same host. Timestamp shifting keeps the gaps between events identical, and subnet-preserving IP mapping keeps neighbouring hosts looking like neighbours.

How is this different from a find-and-replace or a simple masker?

A plain masker such as our Sensitive Data Masker is ideal for a snippet of pasted text. This tool is built for whole log files: it groups multi-line records, filters noise first, validates matches so timestamps and version numbers are not mangled, handles JSON-lines, works across many files with shared tokens, and can reverse the process. For structured tables, use the CSV Anonymizer instead.

Can I undo the anonymization?

If you saved the reversal key, yes. Paste text containing the tokens into the Restore tab and the original values are put back, including shifted timestamps. Redacted, hashed and partially masked values cannot be reversed, because the original is not stored in the output, so use consistent tokens or IP mapping for anything you might need to restore.

What if I only need to hunt for a specific problem, not anonymize?

Untick “Anonymize the kept records” for a filter-only run, or use the include rules to keep just the records that match an error message plus a few records of context. If you would rather explore a log than shrink it, open it in the Log Analyzer, and use Find and Replace for one-off edits.

Does it handle compressed or very large files?

Gzip files are decompressed in your browser, including ones renamed without the .gz extension. Large files are streamed in chunks rather than loaded whole, so multi-hundred-megabyte logs are practical, just slower than small ones.