A browser extension that redacts API keys, passwords & PII the instant you paste them into ChatGPT, Claude, Gemini & friends. 100% local. Zero network calls. Nothing to configure.
You paste a stack trace into ChatGPT to debug it. Buried in there: an AWS key, a DB password, a customer's email. It's now in someone else's logs forever. You do this a dozen times a day without thinking - that's the danger. It's a reflex, not a decision.
airlock sits on that reflex. The moment you paste into an AI chat box, it swaps every secret for a typed placeholder - [AWS_ACCESS_KEY], [CONNECTION_STRING], [EMAIL] - so the model still sees the shape of your problem, but the secret never leaves your machine. A little toast tells you what it caught.
Before ➜ AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
DATABASE_URL=postgres://admin:[email protected]:5432/app
ANTHROPIC_API_KEY=sk-ant-api03-xTf9...
After ➜ AWS_ACCESS_KEY_ID=[AWS_ACCESS_KEY]
DATABASE_URL=[CONNECTION_STRING]/app
ANTHROPIC_API_KEY=[ANTHROPIC_KEY]
🔒 Blocked 3 secrets before paste
AWS_ACCESS_KEY, CONNECTION_STRING, ANTHROPIC_KEY [ Pause 30s ]
Because a clipboard watcher is blind. It can't tell "pasting into ChatGPT" from "pasting my key into my password manager," so it either mangles every secret you ever copy or you turn it off. And polling has a race - copy-then-paste fast enough and the raw secret slips through.
airlock fires on the paste event itself, only on AI sites. No race. It never touches the secret you paste into your vault, your .env, or your terminal - only the one heading into a chatbot.
From source (works today):
- Get the code -
git clone https://github.com/KernelSpecter/AirLock-extension.git, or click Code → Download ZIP on the repo and unzip it. - Open
chrome://extensions(oredge://extensions) - Turn on Developer mode (top-right)
- Click Load unpacked and select the folder that contains
manifest.json - Paste an
.envinto claude.ai and watch it work 🔒
Chrome Web Store / Firefox Add-ons listings: coming soon.
Detection is specific by default - provider-anchored patterns and real validators, not loose regexes that flag everything.
| Category | Detects |
|---|---|
| Cloud & API keys | AWS, GCP, Anthropic, OpenAI, Stripe, Slack, SendGrid, Twilio, Google OAuth, npm |
| Tokens | GitHub PATs (classic + fine-grained), JWTs |
| Credentials | Private keys, proto://user:pass@host connection strings |
| Generic secrets | API_KEY = "…" assignments - entropy-gated, so password="changeme" is ignored |
| PII | Emails, credit cards (Luhn-validated) |
| PII (Aggressive mode) | Phone numbers, IPv4 addresses, US SSNs |
A guard that fires on your normal typing gets disabled in a day. airlock is tuned for specificity over recall on everything on by default:
- Provider-anchored patterns -
AKIA…,ghp_…,sk-ant-…, matched by real prefixes/lengths, not "any long string." - Luhn-checked cards - a 16-digit number only redacts if it's a mathematically valid card, so order IDs and timestamps survive.
- Entropy-gated generics - the
secret = "…"catch-all only fires on genuinely high-entropy values. - Noisy stuff is opt-in - phones, IPs and SSNs live behind Aggressive mode in the popup.
A Node test suite (npm test, 35 passing) pins down both recall on real-shaped secrets and silence on ordinary code - plus the content script's paste-interception logic against fake DOM fields.
airlock makes zero network calls, ever. No telemetry, no cloud, no account, no servers. Everything - detection, redaction - happens in your browser, which is rather the point of a tool whose whole job is to stop data from leaving it. The entire detection engine is one readable file: src/engine.js.
- A content script loads only on AI chat sites and listens for
paste. - The pasted text runs through the detection engine; validators (Luhn, Shannon entropy) confirm candidates.
- On a hit, the paste is cancelled and the redacted text is inserted instead (framework-safe for React textareas and ProseMirror/Lexical editors alike).
- A toast shows what was blocked; the toolbar badge keeps a running count.
Prefer the terminal, or want this in CI? The companion airlock CLI shares this exact detection spec - pipe files through it, or drop it into a pre-commit hook to keep secrets out of your commits.
Detectors are plain data in src/engine.js:
D("linear_key", "secret", "LINEAR_KEY", "high", /\blin_api_[A-Za-z0-9]{40}\b/gd),Add a realistic fake to POSITIVES and a look-alike to NEGATIVES in tests/engine.test.js, run npm test, done. PRs adding provider coverage are very welcome - please keep the Python CLI's detectors.py in sync.
- Chrome Web Store & Firefox Add-ons listings
- Per-site enable/disable from the popup
- Custom patterns & allowlist
- Guard drag-and-drop and file attachments, not just paste
- Optional local-only "restore original" within the chat box
Issues and PRs welcome - especially new provider patterns and false-positive reports (paste the text that tripped it, with the secret itself replaced by Xs).
MIT © KernelSpecter