Clean code and text before you paste it.
Strips what you list and proves it, all in your browser. Flags what else looks sensitive. Your text never leaves this device, and nothing is stored.
We don’t tell you the result is safe. We make it small enough that you can tell.
Code, a log, a stack trace, a config dump.
Removed provably, every occurrence. This is the claim the receipt stands behind.
Deny-listed strings replaced with labelled placeholders.
The checkable receipt (JSON)
Patterns the scanner flagged — for you to decide
Best-effort guesses; nothing here is touched in your output. Add a real one to your list above and process again — you decide, the tool acts.
Vault — placeholder to original
Round-trip — restore your originals
Paste the reply you got back; every placeholder swaps back to the original, in your browser.
Verify any text against the ruleset
The same scan the receipt runs, on its own. Paste anything and see what the ruleset still finds — zero means it flags nothing in that text, a floor, not a guarantee. Shown against your own text, never a scoreboard about anyone else.
What this won’t do — and why, out loud
- — It won’t tell you the output is safe. Safety depends on what you named and on where the output goes next. It removes what you list, provably, and shows you the rest so you can judge.
- — It won’t remove the flagged patterns for you. Those are guesses, and only you know which are real. You promote them; the tool acts.
- — The receipt doesn’t prove when. An offline tool has no trusted clock, so it attests what and which tool — never a timestamp it couldn’t stand behind.
- — The scanner is best-effort, and labelled as such. It helps you build a good list; the provable floor is the list you name, not the guesses.
Pattern detection uses a Gitleaks-derived rule set; the engine is ours.
We invite you to double-check our work
Open your browser’s developer tools, switch to the Network tab, and process something. Nothing leaves your device.
The whole source is on GitHub. Read it.
Found a bug, or a claim that doesn’t hold up? Tell us — an example helps enormously, though we understand if yours is too sensitive to share: code@geodeforge.com
That’s the difference between a privacy policy and a fact.
This slot pays for the page
One static, labeled sponsor link — an image we host and a plain link. No ad network, no tracking script, no third-party request. That is the entire business model, and it is why nothing above has a price.
Sponsor this slot →Clean your code before you paste it into AI.
Pull the API keys, tokens, and connection strings out of your code and logs before they go into an AI chat — the work happens in this browser tab, and a receipt shows you exactly what was removed.
What counts as a secret in code
A secret is any string that grants access or exposes your internals — and in code it hides in ordinary-looking places: a comment, a config default, a committed .env, a stack trace. Before code goes into an AI chat, these are the strings worth pulling:
- API keys and access tokens — the credential that authenticates a request.
- Connection strings — database and service URLs with a username and password baked in.
- JWTs and session tokens — short-lived, but live access while they last.
- Private keys and certificates — SSH keys, signing keys, TLS material.
- Passwords and credentials hard-coded into scripts or config.
- Internal hostnames, IPs, and endpoints that map your network for anyone reading.
You decide the list. Paste your code into GeodeCode above, add the exact strings to remove, and every occurrence is replaced with a labelled placeholder.
How the cleaning happens
The tool runs in JavaScript inside this browser tab. Your code goes into the box, the work happens here, and there is no server behind the page — so your text does not leave your device and nothing is stored.
Every run produces a re-runnable receipt: a small JSON record of what was removed and how many times. It is there so you can confirm the claim rather than take it on faith — run the same input again and the receipt matches.
Alongside the strings you named, the scanner reads the rest of your text and flags anything else that looks sensitive — a key, a token, an address it recognises — and leaves it in place for you to judge. It points; you decide what to add to the list.
Want to check that nothing is uploaded? The double-check our work section on this page walks you through watching your browser’s Network tab while you run a clean, and the verify box lets you scan any text against the same ruleset on its own.
What it does not do
- It does not declare your output safe. It removes what you name, provably, and shows you the rest. Whether that is enough depends on what you named and where the cleaned text goes next — that judgement stays with you.
- It does not rewrite your git history. If a secret was already committed, cleaning the pasted copy here changes nothing in the repository. That is out of scope: you still need to purge it at the source and rotate the value.
- It does not guess perfectly. The scanner is best-effort and labelled as such. The provable floor is the list of strings you name, not the guesses it offers.
Already pasted a key? Rotate it first
If a secret has already gone into an AI chat, treat it as exposed and rotate or revoke it now — once a value has left your hands, retiring it is the only reliable fix, and there is no way to un-send it. Then clean your code before you paste it next time, so the secret never rides along.
Questions people ask
Is it safe to paste code into AI?
Pasting code becomes a risk when the code carries secrets: a key in a comment, a connection string in a config block, a token in a log line all travel with the text. The safe move is to remove those first. Paste your code into GeodeCode above, list the exact strings to strip, and what you send is what you meant to send.
Does the AI store or train on what I paste?
That depends on the AI service and the terms you agreed to, and it is not something this page can control or promise on your behalf. What this page can do is make sure secrets never reach that service in the first place: clean the text on your device, then paste the cleaned version.
What counts as a secret in my code?
API keys and access tokens, database and service connection strings, JWTs and session tokens, private keys and certificates, passwords, and internal hostnames or endpoints. You list the exact strings to remove; the scanner flags further candidates it recognises for you to add.
I already pasted a key — is it compromised?
Treat it as compromised and rotate or revoke it now. Once a value has been sent, retiring it is the reliable fix; there is no way to un-send it. Then clean your code before you paste it next time, so the secret never rides along.
Can I clean code without uploading it anywhere?
Yes, and that is the whole design. The work runs in this browser tab with no server behind it, so your code does not leave your device, nothing is stored, and a receipt shows exactly what changed.
More from GeodeForge
GeodeForge is a one-person studio that crafts open-source tools that do what they say, and let you check — in your browser.