Thanks to visit codestin.com
Credit goes to lib.rs

#pii #redaction #clipboard #secret #security

bin+lib secret-stripper

A small Rust CLI that strips secrets and PII from the clipboard on demand via a global hotkey

1 stable release

new 1.0.0 May 24, 2026

#1959 in Command line utilities

MIT license

670KB
16K SLoC

status

A small Rust CLI that strips secrets from your clipboard on demand. Bind a hotkey, highlight text, press the chord - the clipboard holds a redacted version. Normal Ctrl+C / Ctrl+V is never intercepted.


Quick Start

Linux:

curl -sSf https://secretstripper.download/install.sh | bash

macOS:

curl -sSf https://secretstripper.download/install.sh | bash

Windows (PowerShell):

iwr -useb https://secretstripper.download/install.ps1 | iex

From crates.io (Rust):

cargo install secret-stripper && secret-stripper init

From source (git clone):

git clone https://github.com/kalix127/secret-stripper.git
cd secret-stripper
cargo build --release
sudo cp target/release/secret-stripper /usr/local/bin/
secret-stripper init

Highlight text and press your default chord (Linux Ctrl+Alt+X / macOS Cmd+Shift+C / Windows Ctrl+Alt+C). The clipboard now holds a redacted version - paste with Ctrl+V (Cmd+V on macOS). On Linux the PRIMARY selection is read directly, so you can skip the Ctrl+C.

Run secret-stripper menu to tune settings, or secret-stripper --help for all commands.


Supported OS

OS Status Hotkey backend
Linux ✅ Supported gsettings (GNOME / Cinnamon / Unity / Budgie / Pantheon), gsettings (MATE schema), xfconf-query (XFCE), kwriteconfig + qdbus (KDE Plasma 5/6)
macOS ✅ Supported skhd (~/.skhdrc) or Hammerspoon (~/.hammerspoon/init.lua); manual instructions if neither is installed
Windows ✅ Supported AutoHotkey v2 (%APPDATA%\secret-stripper\secret-stripper.ahk) - install via winget install AutoHotkey.AutoHotkey

Platform setup

macOS setup

There is no zero-install way to register a true global hotkey on macOS without a resident process. Secret Stripper itself stays one-shot, so it delegates hotkey capture to one of two well-known helpers: skhd (lightweight, recommended) or Hammerspoon (heavier, scriptable). If neither is installed, init falls back to printing manual binding instructions.

  1. Install skhd via Homebrew:

    brew install koekeishiya/formulae/skhd
    
  2. Run secret-stripper init. It writes ~/.skhdrc, the launchd LaunchAgent for the daily update check, and the config file. Output includes a "DE binding" line: OK if skhd / Hammerspoon was detected, FAILED with install hints if not.

  3. Grant skhd Accessibility permission. skhd needs this to intercept global hotkeys, otherwise it silently captures nothing. Open System Settings -> Privacy & Security -> Accessibility, click +, add /usr/local/bin/skhd, and toggle it on. If skhd was already running, restart it so the new permission takes effect:

    skhd --restart-service
    
  4. Test the chord:

    echo "[email protected]" | pbcopy
    # Press your chord (default: Cmd+Shift+C)
    pbpaste     # expect: [REDACTED]
    

Hammerspoon alternative: brew install --cask hammerspoon, open it once to grant Accessibility, then run secret-stripper init - it writes the binding into ~/.hammerspoon/init.lua instead of ~/.skhdrc.

Default chord: Cmd+Shift+C. macOS apps often claim Cmd-modifier chords, so if it conflicts with something you use (browser DevTools, Finder "Copy Path", etc.), rebind from secret-stripper menu -> Rebind Hotkey. Two safer options if you want to plan ahead: Cmd+Option+X or Cmd+Ctrl+X.

Windows setup

Windows has no zero-install way to register a true global hotkey. Same constraint as macOS - Secret Stripper delegates hotkey capture to AutoHotkey v2 (the Windows analogue of skhd). AutoHotkey uses the Win32 RegisterHotKey API under the hood and is the only mechanism that delivers the chord reliably across focused windows, full-screen apps, and elevated processes. AutoHotkey is required - init aborts with an install hint if it cannot find it.

  1. Install AutoHotkey via winget:

    winget install AutoHotkey.AutoHotkey
    

    The package installs AutoHotkey v2 to C:\Program Files\AutoHotkey\v2\.

  2. Run secret-stripper init. It writes %APPDATA%\secret-stripper\secret-stripper.ahk, drops a startup .lnk so AHK re-launches the script at every login, and starts the AHK process immediately so the chord is live without a logout.

  3. Test the chord:

    Set-Clipboard "[email protected]"
    # Press your chord (default: Ctrl+Alt+C)
    Get-Clipboard    # expect: [REDACTED]
    
  • The hotkey is limited to Ctrl+Alt+<key> (optionally with Shift); other chords are rejected.
  • No PRIMARY selection: the flow is two steps (Ctrl+C, then your chord).
  • The AHK script runs the redaction with a hidden console, so no window flashes on each trigger.
  • The daily update check runs as a schtasks daily task at 11:00.
  • Uninstall kills the AHK process bound to our script and removes the .ahk file and the startup .lnk. Other AHK scripts you have running are untouched.

What It Detects

Category Examples
🔴 Cloud Secrets AWS keys, Google API keys, Azure credentials, OpenAI tokens, Stripe keys, Heroku API keys
🔴 Auth Tokens GitHub tokens, GitLab tokens, Slack tokens, Discord tokens, JWTs, bearer tokens, NPM tokens
🔴 Cryptographic Keys RSA/EC/OpenSSH private keys, PGP private keys, SSH public keys
🔴 PII Credit card numbers, SSNs, phone numbers, email addresses, passport numbers
🟠 Connection Strings PostgreSQL, MongoDB, Redis, MySQL, JDBC URLs with credentials
🟡 Heuristic Unusual strings, env files with secrets, JSON with password fields, base64-encoded content
🟢 Safe Normal text, emails, documents - no false alerts

For the full list of buckets, severity tiers, and patterns, see DETECTION_COVERAGE.md.


Contributing

See CONTRIBUTING.md for build, test, lint, and commit conventions.

Star history

Star history chart

License

MIT

Dependencies

~19–57MB
~860K SLoC