Remove passwords and keys from commands before sharing
A copied command or settings file can contain a password, access key or cookie that lets somebody sign in as you. Make a separate sharing copy and keep the working original private. These tools read text in your browser. They don't run commands, open files named in them or contact the services they mention.
1. Take only the part needed to explain the problem
A short example is easier to check. Use made-up values where you can. Look for passwords and keys in headers, cookies, database connection details, request bodies and web addresses. Local folder paths and internal server names can also reveal a customer, employer or project.
2. Clean a copied cURL command
cURL makes web requests. Paste one command from a Linux-style shell into cURL cleaner and press Clean cURL command. It replaces supported credentials, headers, cookies, bodies, forms and upload references. Keep the default setting that removes values after ? in the web address. The tool refuses shell variables, command chains and unsupported options. PowerShell and Windows cmd commands aren't supported.
3. Check settings with Configuration scrubber
The scrubber accepts JSON, ENV, INI and simple indented YAML, which are types of settings files. Add any unusual password or key field names in Additional secret key names, separating them with commas. Press Scrub configuration. It replaces supported secret fields and removes supported key blocks and comments from simple settings. Complex or invalid settings may be refused. An error doesn't mean the input was cleaned.
4. Use the history cleaner for past commands
For Bash or zsh command history, use Shell history cleaner and press Clean shell history. It removes whole supported records containing sensitive commands or assignments. If it can't tell where a multiline Bash command ends, it stops for review. Discard remaining history removes everything from that uncertain point onward. Read the result as text; don't run it as a script.
5. Read the result against the original
Check every remaining value, especially server names, paths, database names and unfamiliar settings. Search for private names and the start of any known access token. Personal info redactor can help with names and other personal details. Unusual or encoded secrets may still slip through. Make sure your example still explains the problem.
6. Check the exact copy before sending
Copy or download the output and open that version for a final read. It's a sharing example, not a ready-to-use request or settings file. If you already exposed a real password or key, revoke it or replace it at the service that issued it. Editing a post or snippet doesn't make an old copy stop working.
Good to know
The tools recognize common patterns, so they can miss unfamiliar secrets or replace harmless values. They leave your original file alone. They can't undo an earlier leak or tell you who has used an exposed password or key.