ITBox

Auto-mask phones, IDs, bank cards, emails and other PII in logs.

Switch tool
Built-in rules
Custom regex rules
Input log
Masked output

How to use

Purpose

Log masking tool that auto-detects and masks sensitive info in logs/text: phone numbers, ID numbers, bank cards, emails, IPs, secret tokens, password fields in URLs, sensitive JSON keys (password / secret / authorization, etc). Strategies: full mask (*), partial keep (138****5678), hash replacement (irreversible), custom rules. Common for sanitizing production logs before pasting to tickets/docs/screenshots, compliance audits, sharing logs with the team. All masking runs locally; sensitive originals never upload.

Steps

  1. Paste sensitive-containing log or text
  2. Check categories to mask: phone, ID, bank card, email, IP, token, password fields, custom
  3. Pick strategy: full mask (****), partial keep (138****5678), hash replacement, placeholder [MASKED]
  4. Right pane shows masked output in real time
  5. Custom regex: add project-specific sensitive patterns
  6. Stats: detected X sensitive items, masked Y
  7. One-click copy to safely share
  8. Optional: export masking config (team reuse)

FAQ

What is the standard for phone masking?
Per China financial regulator: ID, bank card, phone numbers must be masked before display in docs / logs / screenshots. Phone: 138****5678 (first 3 + last 4 kept). ID: 110105********1234 (first 6 + last 4). Bank card: 6222********1234 (first 4 + last 4). Tool follows these.
How are JSON password fields auto-detected?
Built-in sensitive key list: password / passwd / pwd / secret / token / authorization / api_key / private_key / access_token / refresh_token / x-auth, etc. The value gets masked when key matches. Custom: add project-specific keys (e.g., wxToken, userSecret).
Hash replacement vs masking?
Hash replacement: replace sensitive value with hash(value). Same input gives same hash — useful for "is this the same user" analysis without exposing plaintext. Caveat: short hashes (e.g., first 8 chars) risk collision; use first 16+ for analysis. Both are irreversible.
How to mask passwords in URLs?
`https://user:password@host` — the password segment must be masked. Tool recognizes URL credentials (user:password@host) and masks: `https://user:****@host`. Common in DB connection strings, git remotes.
Can masking be reversed?
Full mask and hash are irreversible by design. Placeholder mode ([PHONE_1], [PHONE_2] with numbered placeholders) allows manual reverse if you keep the mapping table — but never share mapping and masked data together (defeats masking). In practice, original data stays in the database; masked data is for triage.

Use cases

  • Ticket submission: mask production logs before pasting to colleagues / support
  • Screenshot sharing: debug screenshots with real phone / ID, mask before sharing
  • Documentation: sample API responses with sensitive fields masked
  • Log analysis: analyze production logs without seeing real IPs / user IDs — use hash replacement
  • Compliance audit: ensure no sensitive data leakage before publishing

Use cases

Ticket / screenshot / documentation sanitization, log analysis with privacy, compliance audit. Backend, ops, security, support. China GB/T 35273 (Personal Information Security Specification) compliant. Multi-category detection, multi-strategy, URL credentials, JSON key auto-detection are the differentiators.