Spillproof: Keep Secrets Out of AI Chats

Warns before you paste or send API keys, passwords, card numbers or personal data to ChatGPT, Claude or Gemini. Runs on your device.

Ever pasted a .env file, a customer's email or an API key into an AI chat? Spillproof catches it before it's sent. HOW IT WORKS • When you paste or send something sensitive on an AI chat site such as ChatGPT or Claude, Spillproof stops and shows you what it found. • One click swaps each value for a placeholder like [API_KEY_1] or [EMAIL_2]. The AI still understands your question; it just never sees the real value. • When you copy the AI's answer, Spillproof puts your real values back in. • Or choose "Paste anyway" when it's fine. You decide every time, or set it to replace automatically. WHAT IT CATCHES • API keys and access tokens in the formats used by about 30 popular developer services, plus JSON Web Tokens and private keys • Passwords in config files, .env files, connection strings and command lines • Card numbers (checked with the Luhn algorithm) and IBANs • Email addresses and phone numbers • Government ID numbers from the US, Canada, the UK and India • Your own words: client names, project code names, internal hostnames FEW FALSE ALARMS Spillproof is tuned to stay quiet on normal code: type names, placeholders like "your_api_key_here", test card numbers and documentation examples are ignored. PRIVATE BY DESIGN • Everything runs on your device. Nothing you paste or type is sent anywhere: no servers, no analytics, no account. • Placeholders are kept in memory and forgotten when you close Chrome. • It only runs on AI chat sites, plus any site you add yourself. Free, with no limits.