# Redact private keys

> Redact PEM private keys, header and body, from logs and pasted configuration before they are stored or shared.

Canonical: https://bitbanger.in/entities/private-key
Last updated: 2026-10-27

Category: Credentials and secrets · Entity type: `credential.private_key`

A private key block is trivially detectable by its header, which makes it one of the few secrets you can catch with certainty. Redactly flags the BEGIN header, then extends the span to the matching END marker so the key material goes with it.

## How Redactly detects private keys

- Matched by regex on the BEGIN header for RSA, EC, OpenSSH, and PGP private keys.
- The whole PEM block is replaced when the matching END marker is present, and the header alone is caught when a paste was truncated.
- Runs independently of the model, so no context is required.

## Why redact private keys?

A private key compromises every signature and handshake it backs, retroactively and prospectively.

## Example request

```bash
curl -X POST https://api.bitbanger.in/v1/redact \
  -H "X-API-Key: rdct_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Key loaded: -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEA...", "style": "replace"}'
```

## FAQ

**Does Redactly redact private keys automatically?**

Yes. Send text to the API and every detected type is redacted, including private keys. To redact only this type, pass the value credential.private_key in the entities filter. No training or configuration is required.

**What happens to private keys after redaction?**

With style set to replace, each match becomes [credential.private_key] — the entity type in square brackets. Setting style to mask replaces every character with a block character, and remove deletes the span entirely.

## Related entity types

- [API keys](https://bitbanger.in/entities/api-key) — Redact AWS, OpenAI, Anthropic, GitHub, Google, Slack, and Hugging Face API keys from logs and pasted text.
- [Passwords](https://bitbanger.in/entities/password) — Redact plaintext passwords from configuration dumps, tickets, and transcripts before they are shared.
- [Database connection strings](https://bitbanger.in/entities/connection-string) — Redact connection strings containing embedded credentials for Postgres, MySQL, MongoDB, Redis, and AMQP.

Try it on your own text: https://bitbanger.in/entities/private-key