Clean code and text before you paste it.
Strips what you list and proves it, all in your browser. Flags what else looks sensitive. Your text never leaves this device, and nothing is stored.
We don’t tell you the result is safe. We make it small enough that you can tell.
Code, a log, a stack trace, a config dump.
Removed provably, every occurrence. This is the claim the receipt stands behind.
Deny-listed strings replaced with labelled placeholders.
The checkable receipt (JSON)
Patterns the scanner flagged — for you to decide
Best-effort guesses; nothing here is touched in your output. Add a real one to your list above and process again — you decide, the tool acts.
Vault — placeholder to original
Round-trip — restore your originals
Paste the reply you got back; every placeholder swaps back to the original, in your browser.
Verify any text against the ruleset
The same scan the receipt runs, on its own. Paste anything and see what the ruleset still finds — zero means it flags nothing in that text, a floor, not a guarantee. Shown against your own text, never a scoreboard about anyone else.
What this won’t do — and why, out loud
- — It won’t tell you the output is safe. Safety depends on what you named and on where the output goes next. It removes what you list, provably, and shows you the rest so you can judge.
- — It won’t remove the flagged patterns for you. Those are guesses, and only you know which are real. You promote them; the tool acts.
- — The receipt doesn’t prove when. An offline tool has no trusted clock, so it attests what and which tool — never a timestamp it couldn’t stand behind.
- — The scanner is best-effort, and labelled as such. It helps you build a good list; the provable floor is the list you name, not the guesses.
Pattern detection uses a Gitleaks-derived rule set; the engine is ours.
We invite you to double-check our work
Open your browser’s developer tools, switch to the Network tab, and process something. Nothing leaves your device.
The whole source is on GitHub. Read it.
Found a bug, or a claim that doesn’t hold up? Tell us — an example helps enormously, though we understand if yours is too sensitive to share: code@geodeforge.com
That’s the difference between a privacy policy and a fact.
This slot pays for the page
One static, labeled sponsor link — an image we host and a plain link. No ad network, no tracking script, no third-party request. That is the entire business model, and it is why nothing above has a price.
Sponsor this slot →Sanitize logs and stack traces before you post them.
Pull the tokens, connection strings, and internal paths out of a log or stack trace before it goes into a bug report or a public question — the work happens in this browser tab, and a receipt shows you exactly what was removed.
What hides in a log or a stack trace
A log is written to help you, but it describes your system to everyone who reads it. Before a trace goes into a public question or a shared ticket, these are the things worth pulling:
- Tokens and cookies caught in a logged request — bearer tokens, session IDs, API keys in a header.
- Connection strings and passwords printed in a startup or config line.
- Internal hostnames, IPs, and endpoints that map your network.
- Absolute file paths that reveal a username, a directory layout, a deployment path.
- Database shape — an error that quotes the failing query gives away table and column names.
- Personal data in a logged payload — an email, a phone number, an account id.
You decide the list. Paste the log into GeodeCode above, add the exact strings to remove, and every occurrence is replaced with a labelled placeholder.
How the sanitizing happens
The tool runs in JavaScript inside this browser tab. The log goes into the box, the work happens right here, and there is no server behind the page — so the text does not leave your device and nothing is stored.
Every run produces a re-runnable receipt: a small JSON record of what was removed and how many times each string appeared. It is there so you can confirm the claim instead of trusting it — run the same log again and the receipt matches.
Alongside the strings you name, the scanner reads the rest of the log and flags anything else that looks sensitive — a token, a path, an address it recognises — and leaves it in place for you to judge. It points; you decide what to add to the list.
Want to check that nothing is uploaded? The double-check our work section on this page walks you through watching your browser’s Network panel while you run a clean, and the verify box lets you scan any text against the same ruleset on its own.
What it does not do
- It does not declare your log safe. It removes what you name, provably, and shows you the rest. Whether that is enough depends on what you named and where the log goes next — that judgement stays with you.
- It does not understand every log format. It works on the text you paste as text; it does not parse a specific framework’s structure or reach into an attached file. What it proves is the removal of the strings you listed.
- It does not guess perfectly. The scanner is best-effort and labelled as such. The provable floor is the list of strings you name, not the extra candidates it offers.
Already posted a log? Rotate what it exposed
If a log with a token or a password in it has already gone into a ticket or a public thread, treat that value as exposed and rotate or revoke it now — once it has been posted, retiring it is the only reliable fix, and there is no way to un-post it. Then sanitize the log before you share it next time, so the secret never rides along.
Questions people ask
How do I share a stack trace or log without leaking data?
Clean it before it leaves your hands. Paste the log into GeodeCode above, list the exact strings to remove, and each is replaced with a labelled placeholder. The work runs in this browser tab, so the log does not leave your device, and a receipt records what was replaced.
What sensitive data hides in logs and stack traces?
Tokens and cookies from logged requests, connection strings and passwords, internal hostnames and IPs, absolute file paths that reveal usernames and layout, database shape from a quoted failing query, and personal data in a logged payload.
Can I sanitize a log without uploading it anywhere?
Yes. There is no server behind this page, so the log stays on your device, nothing is stored, and the receipt lets you confirm exactly what changed.
Will it catch everything in the log automatically?
No. The provable floor is the list of strings you name — removed, every occurrence, counted in the receipt. The scanner flags further candidates it recognises, but it is best-effort and you stay the judge.
I already posted a log with a token in it — what now?
Treat the token as exposed and rotate or revoke it now. Once a value has been posted, retiring it is the reliable fix; there is no way to un-post it. Then sanitize the log before you share it next time.
More from GeodeForge
GeodeForge is a one-person studio that crafts open-source tools that do what they say, and let you check — in your browser.