1 stable release
| new 1.0.0 | May 24, 2026 |
|---|
#1959 in Command line utilities
670KB
16K
SLoC
A small Rust CLI that strips secrets from your clipboard on demand. Bind a hotkey, highlight text, press the chord - the clipboard holds a redacted version. Normal Ctrl+C / Ctrl+V is never intercepted.
Quick Start
Linux:
curl -sSf https://secretstripper.download/install.sh | bash
macOS:
curl -sSf https://secretstripper.download/install.sh | bash
Windows (PowerShell):
iwr -useb https://secretstripper.download/install.ps1 | iex
From crates.io (Rust):
cargo install secret-stripper && secret-stripper init
From source (git clone):
git clone https://github.com/kalix127/secret-stripper.git
cd secret-stripper
cargo build --release
sudo cp target/release/secret-stripper /usr/local/bin/
secret-stripper init
Highlight text and press your default chord (Linux Ctrl+Alt+X / macOS Cmd+Shift+C / Windows Ctrl+Alt+C). The clipboard now holds a redacted version - paste with Ctrl+V (Cmd+V on macOS). On Linux the PRIMARY selection is read directly, so you can skip the Ctrl+C.
Run secret-stripper menu to tune settings, or secret-stripper --help for all commands.
Supported OS
| OS | Status | Hotkey backend |
|---|---|---|
| Linux | ✅ Supported | gsettings (GNOME / Cinnamon / Unity / Budgie / Pantheon), gsettings (MATE schema), xfconf-query (XFCE), kwriteconfig + qdbus (KDE Plasma 5/6) |
| macOS | ✅ Supported | skhd (~/.skhdrc) or Hammerspoon (~/.hammerspoon/init.lua); manual instructions if neither is installed |
| Windows | ✅ Supported | AutoHotkey v2 (%APPDATA%\secret-stripper\secret-stripper.ahk) - install via winget install AutoHotkey.AutoHotkey |
Platform setup
macOS setup
There is no zero-install way to register a true global hotkey on macOS without a resident process. Secret Stripper itself stays one-shot, so it delegates hotkey capture to one of two well-known helpers: skhd (lightweight, recommended) or Hammerspoon (heavier, scriptable). If neither is installed, init falls back to printing manual binding instructions.
-
Install skhd via Homebrew:
brew install koekeishiya/formulae/skhd -
Run
secret-stripper init. It writes~/.skhdrc, the launchd LaunchAgent for the daily update check, and the config file. Output includes a "DE binding" line:OKif skhd / Hammerspoon was detected,FAILEDwith install hints if not. -
Grant skhd Accessibility permission. skhd needs this to intercept global hotkeys, otherwise it silently captures nothing. Open System Settings -> Privacy & Security -> Accessibility, click
+, add/usr/local/bin/skhd, and toggle it on. If skhd was already running, restart it so the new permission takes effect:skhd --restart-service -
Test the chord:
echo "[email protected]" | pbcopy # Press your chord (default: Cmd+Shift+C) pbpaste # expect: [REDACTED]
Hammerspoon alternative: brew install --cask hammerspoon, open it once to grant Accessibility, then run secret-stripper init - it writes the binding into ~/.hammerspoon/init.lua instead of ~/.skhdrc.
Default chord: Cmd+Shift+C. macOS apps often claim Cmd-modifier chords, so if it conflicts with something you use (browser DevTools, Finder "Copy Path", etc.), rebind from secret-stripper menu -> Rebind Hotkey. Two safer options if you want to plan ahead: Cmd+Option+X or Cmd+Ctrl+X.
Windows setup
Windows has no zero-install way to register a true global hotkey. Same constraint as macOS - Secret Stripper delegates hotkey capture to AutoHotkey v2 (the Windows analogue of skhd). AutoHotkey uses the Win32 RegisterHotKey API under the hood and is the only mechanism that delivers the chord reliably across focused windows, full-screen apps, and elevated processes. AutoHotkey is required - init aborts with an install hint if it cannot find it.
-
Install AutoHotkey via winget:
winget install AutoHotkey.AutoHotkeyThe package installs AutoHotkey v2 to
C:\Program Files\AutoHotkey\v2\. -
Run
secret-stripper init. It writes%APPDATA%\secret-stripper\secret-stripper.ahk, drops a startup.lnkso AHK re-launches the script at every login, and starts the AHK process immediately so the chord is live without a logout. -
Test the chord:
Set-Clipboard "[email protected]" # Press your chord (default: Ctrl+Alt+C) Get-Clipboard # expect: [REDACTED]
- The hotkey is limited to
Ctrl+Alt+<key>(optionally withShift); other chords are rejected. - No PRIMARY selection: the flow is two steps (
Ctrl+C, then your chord). - The AHK script runs the redaction with a hidden console, so no window flashes on each trigger.
- The daily update check runs as a
schtasksdaily task at 11:00. - Uninstall kills the AHK process bound to our script and removes the
.ahkfile and the startup.lnk. Other AHK scripts you have running are untouched.
What It Detects
| Category | Examples |
|---|---|
| 🔴 Cloud Secrets | AWS keys, Google API keys, Azure credentials, OpenAI tokens, Stripe keys, Heroku API keys |
| 🔴 Auth Tokens | GitHub tokens, GitLab tokens, Slack tokens, Discord tokens, JWTs, bearer tokens, NPM tokens |
| 🔴 Cryptographic Keys | RSA/EC/OpenSSH private keys, PGP private keys, SSH public keys |
| 🔴 PII | Credit card numbers, SSNs, phone numbers, email addresses, passport numbers |
| 🟠 Connection Strings | PostgreSQL, MongoDB, Redis, MySQL, JDBC URLs with credentials |
| 🟡 Heuristic | Unusual strings, env files with secrets, JSON with password fields, base64-encoded content |
| 🟢 Safe | Normal text, emails, documents - no false alerts |
For the full list of buckets, severity tiers, and patterns, see DETECTION_COVERAGE.md.
Contributing
See CONTRIBUTING.md for build, test, lint, and commit conventions.
Star history
License
Dependencies
~19–57MB
~860K SLoC