How to Use DiffRedact for Safe AI Prompting & Code Reviews
DiffRedact combines two critical engineering workflows into a single client-side utility: automatic PII & credential sanitization and precision text/configuration diffing. Before pasting production logs, JSON payloads, or `.env` configuration changes into LLM assistants, bug trackers, or public forums, you can strip every sensitive identifier in one click.
- Paste or Load Sample Logs: Paste your baseline text into the left pane and the updated version into the right pane, or click "Load Sample Log with Secrets" to inspect a realistic production incident log containing AWS keys, Bearer tokens, customer emails, credit card numbers, and IP addresses.
- Select Redaction Rules: Toggle checkboxes for Emails, IPv4/IPv6 addresses, Phone numbers, Credit Cards, API/Bearer Secrets, and Social Security Numbers (SSNs).
- Click "Redact PII & Compute Diff": DiffRedact masks all matching sensitive strings across both inputs in place, updates the live category badge counters, and renders a color-coded comparison below.
- Switch Between Side-by-Side, Unified, Line, or Word Diffs: Use the segmented controls to inspect line-by-line structural changes or granular word-level token edits.
Key Features & Zero-Trust Privacy Architecture
Air-Gapped Browser Execution
Sending unredacted API tokens or customer PII to a cloud-based "redaction API" defeats the entire purpose of sanitization. DiffRedact runs 100% locally in your browser's JavaScript engine with zero network calls.
6-Layer Pattern Detection
Detects RFC-compliant email addresses, IPv4 and compressed IPv6 addresses, North American and international phone numbers, 13–19 digit payment cards, SSNs, and high-entropy credentials (AWS `AKIA`, Stripe `sk_live_`, GitHub `ghp_`, JWTs, and Bearer headers).
LCS Line & Word Diff Engine
Built on a deterministic Longest Common Subsequence (LCS) algorithm supporting both split two-column code review layouts and unified patch views with line numbers.
Instant Audit Counters
Know immediately how many secrets were caught before you copy the sanitized text. Each category reports its exact match count in the status bar.
Technical Guide: Sanitizing Logs & Configs Before Sharing
During high-severity production incidents or debugging sessions, engineers frequently copy stack traces, HTTP request dumps, and configuration files into Slack channels, Jira tickets, or AI coding assistants. Even a single leaked session token or customer record can trigger a compliance breach under GDPR, HIPAA, PCI-DSS, or SOC 2.
Common Secret & PII Patterns Reference
| Category | Replacement Token | Examples of Detected Formats |
|---|---|---|
| API & Cloud Keys | [REDACTED_SECRET] |
AWS Access Keys (AKIA...), Bearer JWTs (eyJ...), GitHub PATs (ghp_...), Slack tokens (xoxb-...), Stripe keys (sk_live_...), and generic api_key= assignments. |
| Email Addresses | [REDACTED_EMAIL] |
Standard and plus-addressed corporate or customer emails (e.g., billing+prod@acme-corp.io). |
| Network Addresses | [REDACTED_IP] |
IPv4 addresses (10.24.118.42, 192.168.1.1) and IPv6 hex segments (2001:0db8:85a3::8a2e:0370:7334). |
| Payment Cards | [REDACTED_CARD] |
13-to-16 digit Visa, Mastercard, Amex, and Discover numbers with spaces, hyphens, or continuous digits. |
| Phone & SSN | [REDACTED_PHONE] / [REDACTED_SSN] |
E.164 international phone formats, US domestic phone numbers, and 9-digit Social Security patterns (XXX-XX-XXXX). |
Best Practices for Reviewing Configuration Diffs
- Use "Ignore Whitespace" When Comparing Re-indented YAML/JSON: Code formatters often alter indentation without changing semantic keys. Toggling Ignore Whitespace highlights only real value mutations.
- Use "Word Diff" for Long Log Lines: When two log entries differ only by a timestamp, request ID, or status code inside a 300-character line, switching from Line Diff to Word Diff pinpoints the exact token change.
- Sanitize First, Diff Second: When comparing two production log snapshots, redacting ephemeral tokens and IP addresses first eliminates noisy line differences so you can focus on actual error state changes.
Frequently Asked Questions (FAQ)
Does DiffRedact transmit my logs or source code over the internet?
Never. All regular expression scanning, token replacement, and Longest Common Subsequence (LCS) diff calculations happen strictly inside your browser tab. You can disconnect from Wi-Fi after loading the page and use every feature offline.
Can I use DiffRedact only as a PII sanitizer without comparing two files?
Yes! Simply paste your text into either pane, select the PII/secret checkboxes you want to mask, and click Redact PII & Compute Diff. You can then click Copy Left or Copy Sanitized Right to grab your cleaned text immediately.
What types of API keys and secrets are recognized?
DiffRedact targets both vendor-specific prefixes—including AWS (`AKIA`, `ASIA`), GitHub (`ghp_`, `gho_`, `github_pat_`), Stripe (`sk_live_`, `rk_live_`), Slack (`xoxb-`, `xoxp-`), OpenAI/Anthropic style keys (`sk-...`), JSON Web Tokens (`eyJ...`)—and key-value assignments like `password=`, `secret=`, `token=`, and `Authorization: Bearer` headers.
What is the difference between Side-by-Side and Unified Diff views?
Side-by-Side displays the original file on the left and the modified file on the right with aligned line numbers, ideal for wide desktop monitors. Unified View stacks additions (`+`) and deletions (`-`) into a single vertical stream, matching standard `git diff` output.
Why should I redact IP addresses and emails before pasting logs into AI tools?
Customer email addresses and client IP addresses are classified as Personally Identifiable Information (PII) under GDPR and CCPA. Replacing them with deterministic placeholders like [REDACTED_EMAIL] preserves the structural context the AI needs to debug your issue while eliminating compliance risk.