What Cloakpaste detects
Cloakpaste finds sensitive items in two ways. Pattern detectors match known formats, and check a checksum where one exists. An on-device model finds people's names, places and addresses, which have no fixed format. You can turn each kind on or off under What to hide in the settings.
Secrets and keys
| Kind | Placeholder | What it catches |
|---|---|---|
| Private key | PRIVATE_KEY | PEM blocks from -----BEGIN … PRIVATE KEY----- to the matching END line, including OpenSSH and PGP private key blocks |
| API key | API_KEY | OpenAI and Anthropic style sk-… keys, AWS access key IDs, GitHub, GitLab, Slack (tokens and webhook URLs), Stripe, Google, Hugging Face, npm, SendGrid, Twilio and Telegram bot tokens |
| JSON web token | JWT | Tokens starting eyJ… with three dot-separated parts |
| Access token | TOKEN | Discord tokens, and the value after Bearer, Basic or Token |
| Password | PASSWORD | The password in a URL like postgres://user:pass@host, a value whose key name mentions a password (DB_PASSWORD=…), and phrases like "my password is …" |
| Secret value | SECRET | Values assigned to key names that suggest a secret, such as "client_secret": "…" or API_TOKEN=… |
For passwords and secrets in config, Cloakpaste skips values that are clearly not secrets: template references such as ${VAR} or <your-key>, empty values, plain numbers (except for PIN or password keys) and settings such as max_tokens: 1024.
Financial
| Kind | Placeholder | How it is found |
|---|---|---|
| Card number | CARD | 13 to 19 digits that pass the Luhn checksum and match a card issuer, written with consistent spaces or dashes |
| IBAN | IBAN | Country code and digits that pass the mod-97 check |
| Bank account | BANK_ACCOUNT | US bank account numbers, found by the model |
People and IDs
| Kind | Placeholder | How it is found |
|---|---|---|
| US SSN | SSN | The 123-45-6789 format, excluding numbers that are never issued |
| Aadhaar number | AADHAAR | 12 digits, checked with the Verhoeff checksum |
| PAN (India) | PAN | The ten-character PAN format |
| ID document | ID_NUMBER | US passport, driving licence and ITIN numbers, found by the model |
| Person name | PERSON | The model |
| Place or address | LOCATION | The model |
| Organisation | ORG | The model. Off by default |
Contact details and network
| Kind | Placeholder | How it is found |
|---|---|---|
| Email address | EMAIL | Address pattern (image names like logo@2x.png are skipped) |
| Phone number | PHONE | International numbers starting with +, US numbers, and Indian mobile numbers |
| IP address | IP | Valid IPv4 and IPv6 addresses; loopback addresses such as 127.0.0.1 and ::1 are skipped |
| MAC address | MAC | Six pairs of hex digits separated by : or - |
Your terms
| Kind | Placeholder | How it is found |
|---|---|---|
| Custom term | TERM | Words in your Always hide list. See Always hide and never hide. |
Optional detectors
Two detectors are off by default because they flag ordinary code:
- Organisation names, under What to hide. They often match product and library names.
- Also hide random-looking strings, under Detection. It catches key formats no pattern knows, as long strings of mixed letters and digits. It may also hide hashes and IDs in code.
The model
Find names and addresses with the on-device model (on by default) uses a 29 MB model that runs inside the browser. A typical paste takes 10 to 80 milliseconds; the first paste after the browser starts takes about a second while the model loads. The model is English-focused. Pattern detection works in any language.
In very long pastes, names are checked in the first 50,000 characters; the notice then says so. If the model cannot run, the notice says Name detection was unavailable for this paste. and pattern detection still applies.
Turn the model off to use only pattern detection.
Values seen before stay hidden
Once a value has been hidden on a site, Cloakpaste hides it again in later pastes on that site, even where a detector would have missed it, and gives it the same placeholder.
WARNING
No detector is perfect. Names in unusual forms, places the model does not recognise, and secrets in formats that no pattern knows can slip through. Look at the notice after each paste.