🤐 redukt

A small command-line tool for redacting sensitive data from text input — passwords, tokens, API keys, IP addresses and emails. Can be extended with custom regex rules.

Before	After
password=CorrectHorseBatteryStaple123!	password=<redacted>
remote_addr=203.0.113.17	remote_addr=<ipv4_1>
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.fake.payload.signature	Authorization: Bearer <redacted>
X-API-Key: sk_test_51N7aBcDeFgHiJkLmNoPqRsTuVwXyZ123456	X-API-Key: <redacted>
email=alice@example.com	email=<email_1>

Installation

Build from source:

git clone https://git.glsk.net/glsk/redukt
cd redukt
cargo build --release
target/release/redukt --help

Arch Linux users can install from the AUR:

paru -S redukt

Debian/Ubuntu packages and binaries can be downloaded from the release page.

Usage

redukt [OPTIONS] [FILE]

If no FILE is given, reads from standard input. Redacted output is written to stdout.

Options

Flag	Description
-c, --config <CONFIG_FILE>	Load a custom YAML config.
--include-local	Redact local/private IPs too (by default only public IPs are redacted).
--include-domains	Redact domains (like mail.example.com).

Examples

Redact a file:

redukt app.log > redacted.log

Pipe a stream:

tail -n 1000 /var/log/app.log | redukt > redacted.log

Run with a custom config:

redukt -c extra-rules.yaml input.log

In Klipper you can use this command:

printf '%s' "<%s>" | redukt

Custom config

A config file is a YAML list of rules:

rules:
  - name: nickname
    regex: '(?i)\b(?:smith|jsmith)\b'
    replacement: '<me>'

  - name: users
    regex: '(?i)((?:[A-Za-z0-9_]+_)?user\s*[=:]\s*)(\S+)'
    replacement: '$1<user_{n}>'

  - name: phone_number
    regex: '\+?\d{1,3}[ .-]?(?:\(?\d{3}\)?|\d{3})[ .-]?\d{3}[ .-]?\d{4}'
    replacement: '<phone_{n}>'

• name — descriptive label.
• regex — Rust regex crate syntax. Capture groups may be referenced as $1, $2, ... in replacement.
• replacement — group and text it will be replaced with. If the replacement contains {n}, each unique matched value is mapped to a numbered placeholder and reused consistently.

More examples in sample.yaml.

Default config

Redukt also checks for a default config file in $HOME/.config/redukt/config.yaml or $HOME/.config/redukt/config.yml and applies it automatically first, even without a --config flag.

AI

This project was developed with LLM assistance.

License

Licensed under GPL-3.0 or later.