DHIVA LABS · LEARN

Appearance

Cloakpaste ​

Cloakpaste is a browser extension for Chrome and Firefox. When you paste text into an AI chat such as ChatGPT, Claude or Gemini, it swaps emails, API keys, card numbers, names and other sensitive items for placeholders like [EMAIL_1] before the text lands in the chat box.

A chat box with placeholders in place of private data, and the Cloakpaste notice listing seven hidden items
  1. 1Placeholders — What the chat site receives instead of the real values.
  2. 2Hid 7 items before pasting — The notice after each paste, with a count by kind.
  3. 3Close — Dismisses the notice. It also closes by itself.
  4. 4Paste original — Puts the original text back if you meant to share it.
  5. 5Details — Shows or hides the list of hidden items.
  6. 6Hidden items — Each placeholder with a partly masked original.
A paste on a demo chat page. On real sites the notice looks the same.

What it does ​

text
Hi team, ping John O'Neill (john.oneill@acme.io) about the Chennai rollout.
OPENAI_API_KEY=sk-proj-Q8m2N4b7X1c9V3z5K6j0L2p4R7t9W1y3

becomes

text
Hi team, ping [PERSON_1] ([EMAIL_1]) about the [LOCATION_1] rollout.
OPENAI_API_KEY=[API_KEY_1]
  • Catches pastes on 13 AI chat sites out of the box, and on any other site you add.
  • Finds secrets and personal data with pattern rules and checksums (keys, cards, IBANs, emails, phone numbers, IP addresses) and a small on-device model (people's names, places and street addresses). See What Cloakpaste detects.
  • Keeps placeholders consistent. The same value always gets the same placeholder on a site, so the AI can still tell who is who.
  • Shows originals in replies. When the AI answers with [EMAIL_1], hover it to see the original; copy the reply to get the originals on your clipboard. See Restore the originals.
  • Your own words. An Always hide list for client names or project codenames, and a Never hide list for values that are fine to share.

Everything runs on your device. Cloakpaste has no server, account or analytics, and makes no network requests.

WARNING

Cloakpaste reduces accidental leaks; it does not guarantee none. Detection is pattern-based plus a model, and it can miss things. Only pasted text is checked: text you type and files you upload are not. Read the limits before relying on it.

Who it is for ​

Developers pasting logs and config into AI chats, support staff pasting customer emails, and anyone who wants a safety net before sharing text with a chat service.

Platforms ​

  • Chrome 116 or later, and other Chromium browsers such as Edge and Brave
  • Firefox 140 or later

Next steps ​