String obfuscator

Sometimes you need to refer to a secret without revealing it: confirming which API key is configured, discussing a customer's IBAN in a support ticket, or writing tokens to logs. String obfuscation masks most of the characters while keeping a few visible, so the value is identifiable but not usable. This is the same idea as showing only the last four digits of a credit card.

How to use it

1. Paste the string.
2. Choose how many characters to keep visible at the start and end, and the masking character.
3. Copy the obfuscated version.

Examples

• An example key demo_key_ABCD1234EFGH5678 with 4 characters kept at each end becomes demo****************5678.
• IBAN DE89370400440532013000, keeping the last 4: ******************3000.
• Email [email protected]: an*******@example.com if only the local part is masked.

When to use obfuscation

• Logs and error messages: never log full tokens, passwords or card numbers. Mask them at the point of logging.
• Support and screenshots: confirm which value is meant without exposing it.
• UI display: show which key is active in settings pages.

Important limits

• Obfuscation is not encryption. It is one-way display masking; the hidden characters are simply removed from view.
• Keep the visible part small. Showing too many characters of a short secret can make it guessable.
• For payment card data, PCI DSS allows at most the first six and last four digits to be displayed.
• If a secret was already exposed in full, rotate it; masking afterwards does not help.

Obfuscation happens in your browser, so the original string is never sent anywhere.