How to keep secrets out of AI prompts

Before you paste anything into an AI chat, scan it for secrets: provider API keys, cloud access keys, tokens, private keys, and passwords inside URLs or env lines. Replace each one with a placeholder such as <API_KEY>, which the model needs no less than the real value. Use an on-device model when the text cannot be cleaned, and revoke any key that has already gone out.

How secrets end up in prompts

Almost nobody pastes an API key on purpose. Secrets ride along inside something else. A developer pastes a stack trace, and the log line above the error prints the full connection string. Someone asks why their app will not start and pastes the whole .env file. A curl command copied from the terminal still has the Authorization header in it. A JSON response includes an access token next to the field you actually care about.

Once sent, that text is on someone else's servers. Depending on the provider and your settings, it may be stored, logged or reviewed. You no longer control who sees it or for how long, and you cannot take it back.

What to look for

Most secrets have a recognisable shape. These are the ones worth checking for every time.

A JWT deserves a note of its own. Its payload is readable by anyone, and while it is valid it often works as a login. If you want help understanding a token, share its decoded header and payload, not the token. The guide on how to decode a JWT shows how to do that offline.

How to mask secrets

Masking means replacing the secret with a placeholder that keeps the meaning. The model can still see that a value is a database URL or a bearer token; it just cannot see the value.

Before:
DATABASE_URL=postgres://app:[email protected]:5432/prod
Authorization: Bearer eyJhbGciOi...

After:
DATABASE_URL=postgres://app:<PASSWORD>@db.internal:5432/prod
Authorization: Bearer <TOKEN>

A few habits help:

• Keep the prefix if it matters, for example sk-...REDACTED, so the model knows which provider you mean.
• Use different placeholders for different secrets, so the model can tell them apart in its answer.
• Trim the paste. Send the ten lines around the error, not the whole log.
• Never paste a whole .env file. Paste .env.example, or the variable names alone.

Do not rely on Base64 or similar to disguise a value; it is reversible by anyone, as the guide on Base64 on a Mac explains.

Use an on-device model when you can

Some text cannot be cleaned easily: a long log full of customer data, or a config you do not have time to read line by line. For that, a model running on your own machine is the better choice. Apple Intelligence has an on-device model that runs on the Mac itself. A local server such as Ollama or LM Studio runs open models on your hardware. Nothing goes to a third party, so there is nothing to leak.

On-device models are not always as capable as the large cloud ones. A practical split is to use the local model for anything sensitive and a cloud model, with masked input, for the rest.

If a key has already leaked

Assume it is compromised. Deleting the chat does not undo the send.

1. Revoke or rotate the key in the provider's dashboard straight away. This is the step that actually matters.
2. Update your apps with the new key, ideally from a secrets manager rather than a file.
3. Check usage and logs for activity you do not recognise, and check billing for cloud and AI keys.
4. Tell whoever owns the system if the key was not yours alone.

The same steps apply to a key pushed to a public repository. If you need to compare a config file before and after a change without sending it anywhere, a checksum helps; see MD5 vs SHA-256 checksums.

How DailyUtil does it

Every tool in DailyUtil has AI actions: Explain, Fix, Sample and Ask. You choose the engine. Apple Intelligence runs on the Mac and nothing leaves it (it needs macOS 26 with Apple Intelligence turned on). Or you use your own key for Claude, OpenAI, Gemini, Grok or an OpenAI-compatible server such as Ollama or LM Studio. There is no AI key or AI server of ours, and your keys are kept in the macOS Keychain.

Before any cloud AI request, DailyUtil scans the input for provider keys (sk-, sk-ant-, AKIA, ghp_, xox, Stripe sk_live_), private key blocks, JWTs and bearer tokens, passwords in URLs and env lines. If it finds any, it lists what and where, and offers "Mask and send" (the default), "Use Apple Intelligence" or "Send as is". A JWT is sent only as its decoded header and payload. Read more on the AI page, or download DailyUtil for macOS 14 or later on Apple Silicon.

Questions people ask

Is it safe to paste an API key into ChatGPT or Claude?

Treat it as unsafe. The key leaves your machine and is held by a service you do not control. The model does not need the real value to help, so replace it with a placeholder, and revoke any key you have already sent.

Does deleting the chat remove the leaked secret?

You cannot be sure it does. The text was already sent and may have been stored or logged. The only reliable fix is to revoke or rotate the key with its provider and use a new one.

Are on-device AI models private?

A model that runs entirely on your machine, such as Apple Intelligence on a Mac or an open model in Ollama, does not send your text to a third party. Check each app's own settings, since some can fall back to cloud services.

What is the easiest way to mask secrets in a log?

Search for the common prefixes and patterns, such as sk-, AKIA, ghp_, Bearer and passwords in URLs, and replace each value with a named placeholder. Send only the lines around the problem rather than the whole log.