# Mask PII in application logs

> Redact IPs, emails, tokens, and device identifiers from log lines before they are shipped to a log aggregator or pasted into a ticket.

Canonical: https://bitbanger.in/use-cases/logs
Last updated: 2026-10-27

Logs are the highest-volume source of accidental PII exposure in most engineering organisations. They are also the place where redaction is easiest to automate, because every line goes through the same code path.

## What this gives you

- IP addresses, emails, JWTs, API keys, and MAC addresses are all format-matched, so they are found even in a single-value log line.
- Use style=mask to keep line length and column alignment stable in fixed-width log viewers.
- Works on structured lines as plain text; JSON payloads can go through the same endpoint unchanged.
- One call per batch keeps latency off the hot path.

## Request

```bash
curl -X POST https://api.bitbanger.in/v1/redact \
  -H "X-API-Key: rdct_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "2026-10-26T09:14:02Z client 203.0.113.47 user jane@example.com status 500", "style": "mask"}'
```

## FAQ

**Does masking change the line length?**

No. Each character of the matched span is replaced with one block character, so offsets and alignment stay the same.

**Can I redact only IPs and tokens and leave the rest?**

Yes. Pass the entity filter with the exact type names you want to keep, for example ["contact.ip_address", "credential.jwt"].

## Related

- [All 40 entity types](https://bitbanger.in/entities/)
- [Integrations](https://bitbanger.in/integrations/)
- [API reference](https://bitbanger.in/docs)

Live demo: https://bitbanger.in/use-cases/logs