FREE TOOL
Paste a running-config or any show output. Passwords, hashes, keys, SNMP communities, certificates, serial numbers, and public addresses come back as placeholders, and the commands around them stay intact. It runs in your browser, so nothing you paste leaves this page. No account, no sign-in.
Always replaced: passwords, hashes, keys, pre-shared keys, SNMP communities, and certificate blobs.
Anything not on this list is still in the text below. Read the output before you paste it anywhere.
| Category | Replacements | Distinct values |
|---|
Keep this on your machine. It reverses the addresses, names, and identifiers so you can read an assistant's answer against the real network. Passwords and keys are not listed, because there is no reason to map those back.
| Original | Placeholder |
|---|
The tool reads the text line by line and looks for the places a configuration keeps a secret: the value after secret or password, key strings, SNMP communities, pre-shared keys, NTP authentication keys, and the hex blobs inside a certificate chain. The command stays and the value goes, soenable secret 9 $14$3Yfr$KpVw... comes back asenable secret 9 <REDACTED-SECRET>. An assistant can still see that you use type 9 hashing without seeing the hash.
Repeated values get the same placeholder every time. If one public address sits on three interfaces, it is 203.0.113.1 in all three, so the peering relationships survive the scrub. Replacing every value with a row of asterisks destroys those relationships, and the relationships are usually the thing you are asking about.
Private addressing is left alone. 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 do not identify anyone, and stripping them would make the config unreadable for no benefit. Public addresses are mapped into the documentation ranges reserved for exactly this (203.0.113.0/24, then 198.51.100.0/24, then 192.0.2.0/24), so the output still parses and is obviously not real.
Removing the values does not anonymize the network. Interface naming, VLAN names, routing design, and the shape of the topology still describe your environment, and someone who knows the industry can often tell a great deal from those alone. If the config came from a customer network under an agreement, it is still that customer's config after the passwords come out, and a placeholder does not change what you signed.
It also does not rotate anything. If a real secret has already been pasted into a chat window, a search box, or a ticket, that secret is out. Sanitizing the next paste is the right habit; it is not a remedy for the last one.
Pasting into a web page is the demo. The version that pays off is the same substitution table wired into your collection script or a commit hook, so raw output never reaches a prompt or a repository in the first place. That is a few dozen lines of Python and a list of patterns you extend as you meet new platforms.
The paid course covers this in lesson 22, Secrets, Credentials, and Safe AI Usage, next to the rest of the working loop: collect the data, put it in git, generate the artifact, and prove the change landed. If you want to see how the teaching reads before you buy anything, lesson 16 is free with an account and includes a graded lab.