Privacy Shield

Detects API keys, tokens, passwords, and other sensitive data as you paste, on-device, and offers a redacted version instead.

Warns you before you paste API keys, tokens, or passwords into AI chats and other sites - entirely on-device, your text never leaves your browser. Privacy Shield warns you the moment you're about to paste an API key, token, password, or other secret into any website — including AI chat and assistant tools. See it in action Paste something like sk-proj-8x7K2mN9qR4vL1pQ3sT6 into a chat box, and a warning appears before anything is sent - offering to paste [REDACTED_API_KEY] instead, paste the original anyway, or cancel. Paste a support log containing jane@company.com, 10.0.4.221, and password: "correcthorsebattery9" in one go, and all three get caught and redacted together — not just the first match. Paste a real-looking card number and it's checked with an actual checksum (the same math card issuers use), not just a digit-count guess - so a random 16-digit string in your text doesn't get flagged by mistake. How it works Detection runs entirely on your device - pasted text is never sent anywhere, to us or anyone else. Every warning gives you three clear choices: Paste Sanitized (redact and paste the rest), Paste Anyway, or Cancel. Works in plain text fields, textareas, and rich editors - including React/Vue-based apps. Add your own custom detection rules for company-specific secret formats, on top of 15+ built-in categories (API keys, tokens, private keys, database credentials, credit cards, IP addresses, and more). Where it works Runs on every page you visit - chat-based AI tools included — plus any custom site you add in Settings. Detection behaves identically everywhere; no page is ever assumed safe by default. Pricing One-time purchase, no subscription. Personal covers one browser profile; Multi-profile covers up to three. Every feature is included in both plans — the only difference is how many profiles your key activates on. Privacy first Nothing you paste, and nothing Privacy Shield detects, is ever sent anywhere - not even as a hash. There's no server, no analytics, no third-party code. The only network calls this extension ever makes are to activate or validate your purchased license key with Dodo Payments, our payment provider.