UsefulTab
String Obfuscator
Mask API keys, tokens, and IBANs.
Paste a secret to mask it
Enter one or more secrets, choose how many characters to keep at each end, and the middle is masked instantly. Turn on preserve delimiters to keep the shape of IBANs and card numbers. Everything runs in your browser.
Runs entirely in your browserMask secrets for safe sharing
When you need to show an API key, token, IBAN, or card number in a doc, ticket, or screenshot without revealing it, this tool masks the middle and leaves just enough visible to recognise. Choose how many characters to keep at the start and at the end, pick the mask character (asterisk, dash, or hash), and the rest becomes a run of that character. Turn on preserve delimiters to keep spaces and separators like - / _ . : in place — useful for IBANs and grouped card numbers — so the shape stays readable while the digits are hidden. Each line is masked independently, and output updates as you type. Everything runs in your browser; nothing you paste is uploaded.
Common questions
What do keep-first and keep-last do?
They set how many characters stay visible at the start and the end of each line; everything between them is replaced with the mask character. For example, keep-first 4 and keep-last 4 on an API key shows the leading and trailing four characters and masks the middle.
What does preserve delimiters do?
When on, spaces and the separators - / _ . : are left exactly where they are and are never masked, and they do not count toward keep-first or keep-last. This keeps the shape of grouped values like IBANs (GB29 NWBK …) or card numbers (4111 1111 …) readable while hiding the significant characters.
Can I mask several secrets at once?
Yes. Put one secret per line in the input and each line is masked independently with the same settings, preserving your line breaks. Then copy the whole result at once.
Is this reversible — can the original be recovered?
No. Masking throws the hidden characters away and replaces them with the mask character, so the output cannot be turned back into the original. It is for safe display, not encryption — use the Text Encrypt / Decrypt tool if you need to protect and later recover a value.
Is anything I paste uploaded?
No. The masking is plain string manipulation done entirely in your browser tab. Nothing you enter is sent to a server, so it also works offline.