cURL Secret Scrubber
Paste a Chrome DevTools cURL command and replace credentials with dummy values before you share it.
This runs in your browser. The command is not uploaded, stored, logged, or executed.
Detection uses header names, field names, and token shapes. It can miss a secret or redact an ordinary value. Review the result before sharing it.
The sanitized command will appear here.
Share a cURL command without its credentials
Copy as cURL from Chrome DevTools includes the live request: authorization headers, cookies, API keys, and sometimes a JSON body. Paste that command here to get a version you can put in a bug report. The original stays in the input box on this page, and the output uses placeholders such as [REDACTED_AUTH].
How to scrub a cURL command
- 1. Copy the request — in Chrome DevTools, choose Copy as cURL for Bash or Windows cmd.
- 2. Scrub it locally — paste it above and choose Scrub secrets. The page compares the command with known credential names and token shapes.
- 3. Review and copy — read the sanitized command and the removal list, then copy the result.
What the rules cover
- Authorization, proxy authorization, API key headers, and other known credential headers.
- Cookie values, with the cookie names left visible so you can see what was removed.
- Basic and Bearer credentials,
--user, and URL userinfo. - Query parameters and JSON fields whose names match tokens, passwords, sessions, secrets, and API keys.
A custom field name can pass through. A harmless field named key can be redacted. The removal list is there so you can check both cases.
Related tools
- How to remove secrets from a cURL command — what Copy as cURL leaks and a sharing checklist for QA and developers.
- JSON Formatter — format a response body after the credentials are gone.
- Replay HTTP requests — capture a webhook once and replay it from MockFlow.
- JWT Decoder — inspect a token locally before you decide it is safe to share.
- All developer tools — JSON, timestamps, UUIDs, URL encoding, and the rest of the free toolkit.
Frequently asked questions
- Does the cURL secret scrubber upload my command?
- No. Scrubbing runs in your browser. MockFlow does not send the command to an API, write it to local storage or cookies, or include it in analytics.
- Will MockFlow run the pasted cURL command?
- No. The page parses the text with local rules. It does not start a shell, evaluate substitutions, read referenced files, or contact the URL.
- Which secrets does it redact?
- It redacts known credential headers, cookie values, user and password options, URL userinfo, sensitive query names, and sensitive JSON field names. It also redacts values that match common token shapes such as Bearer credentials and JWTs.
- Can it miss a secret?
- Yes. Detection is rule-based and can miss a custom field or redact an ordinary value. Read the sanitized command and the removal list before sharing it.
- Which cURL formats are supported?
- The tool supports Bash, macOS, and Linux cURL copied from Chrome DevTools, plus Windows cmd cURL. PowerShell continuations are rejected so they are not treated as safe.
- Is there an input size limit?
- Yes. Commands larger than 256 KiB are rejected, and JSON bodies deeper than 50 levels are removed instead of being partially scrubbed.