SafePrompt: Paste Protection for AI Chats

Checks what you paste into ChatGPT, Claude and Gemini for secrets and personal data, and offers a redacted version.

SafePrompt checks what you paste into ChatGPT, Claude and Gemini before the page receives it. If the paste contains a secret or personal data, it holds the paste, shows you what it found, and offers a version with those values replaced. What it catches • API keys and tokens for AWS, GitHub, Stripe, Slack and OpenAI • Private keys • Database connection strings and the passwords inside them • JSON Web Tokens • Passwords and secrets assigned in config files • Email addresses • Private IP addresses and internal hostnames It ignores the placeholders found in documentation, such as "your-api-key-here", so a README or a tutorial doesn't set it off. How it works When you paste, SafePrompt scans the text in your browser. If it finds something at or above the risk level you chose, a dialog shows the text as it would be sent, with each sensitive value replaced by a placeholder such as [DB_PASSWORD_1]. You then choose to paste the redacted version, paste the original, or cancel. The placeholders keep the shape of the text, so the assistant can still help with it. The same value always gets the same placeholder. Private by design • Everything runs on your device. SafePrompt makes no network requests: no analytics, no telemetry and no account. • It runs only on ChatGPT, Claude and Gemini, and reads only what you paste into the message box. • Your pasted text is never stored. An optional history records what kind of thing was found and what you chose, never the text. • The code is open source: https://github.com/rspanu27/safeprompt You stay in control • Choose the risk level that brings up the dialog. • Turn kinds of data on or off. • Pause it for one site, or everywhere, from the toolbar. • Add values you consider safe to an allowlist. What it does not do SafePrompt checks pasted text only. It does not check text you type, files you upload or images. It recognises known formats, so it can miss a secret that has no recognisable shape. If a site changes and SafePrompt can no longer find the message box, it tells you instead of failing silently. Try the scanner without installing anything: https://rspanu27.github.io/safeprompt/ Questions or problems: https://github.com/rspanu27/safeprompt/issues or raul.safeprompt@gmail.com.