Redact your prompt before it leaves the browser

A Chrome extension for ChatGPT, Gemini and Claude. Identifiers, API keys and your own terms become placeholders on the way out, and the real values come back in the reply — all inside the page.

Add to Chromev0.8.3 · free · Chrome 111+

Type something. Watch what the model would get.

You type

🛡️ 5 items (Credit card, IBAN, Email, Swiss AHV / AVS, Custom terms) will be kept local when you send

What the provider receivesChatGPTGeminiClaude

Draft a friendly reply: we double-charged card [CARD_1] for CHF 240. Refund to IBAN [IBAN_1], confirm to [EMAIL_1], and put AHV [AHV_1] on the case. It's a [CUSTOM_1] account.
  • Credit cardcard:…1111✓ checksum
  • IBANCH…57 (21)✓ checksum
  • Emailh***@bluewin.ch
  • Swiss AHV / AVS756.XXXX.XXXX.97✓ checksum
  • Custom termscustom rule
Try another identifier type

Detection runs in this tab, from the same source the extension bundles — nothing you type here reaches a network. Every value above is synthetic.

What it catches

20 identifiers

Shape and check digit must agree, so ordinary text is never touched — Swiss AHV, IBAN, cards, and national IDs across Europe, the Americas and Asia.

9 secrets

AWS, OpenAI, Anthropic, Google, GitHub, Slack and Stripe keys, JWTs and PEM private keys — matched on their structured credential shape.

Your own terms

A client name, a code name, a domain, a regex. Or add one from the ready-made library in a click: US SSN, UK NI, internal IPs, hostnames, MAC addresses — and more in the preset library.

Proof, not promises

The Sovereign Shield inspector open beside a Gemini composer. The 'You typed' pane shows a name, an AHV number, an IBAN, a mobile number, an email and a card number; the 'What the provider receives' pane shows the same text with [AHV_1], [IBAN_1], [PHONE_1], [CARD_1] and the stand-in address alice.morgan@example.org in their place
Your prompt on top, what Gemini would actually receive below — five values replaced. Smokescreen is on here, so the email left as a stand-in while the checksum-validated ones stay bracket tokens. The name is untouched: names have no check digit to verify, so the guard doesn't guess.

The fine print

Where do the real values ever appear?

Three places, all local: the text painted on screen, what you copy from it, and the inspector panel. Never the request, never extension storage, never the activity log — which records type, time and site, and never a value.

Smokescreen: stand-ins instead of [EMAIL_1]

Off by default. With it on, an email or a custom term is sent as a plausible stand-in like alice.morgan@example.org, which reads as ordinary prose to the model. Checksum-validated identifiers never get one — a valid-looking fake AHV or IBAN would be some real person's number.

What happens if a site changes its API?

You get told. The guard hooks each site's real endpoint by name; if your composer drains and no request went through it, a banner says that message was not inspected — and offers to report it in one click. The report carries the hostname, version, build stamp and symptom, and nothing else. It is the extension's only outbound channel, and only if you click.

What it does not do

It guards the prompt you type — not the files you attach, so redact a document before you upload it. Names and street addresses have no checksum and need a named-entity model, so they are deliberately left alone. And it doesn't try to survive deliberate obfuscation: it is the outer, deliberately-dumb layer of a defence-in-depth stack.

Using Gemini? One quirk worth knowing

If a pasted message doesn't send on the first Enter, press it again or click the send arrow. That is Gemini's own editor dropping the first keypress before its send button is ready — it happens with the extension removed too. The guard only rewrites the outgoing request, never the send action.

Build it from source

The source is in extension/ — npm run build, then Developer mode → Load unpacked → extension/dist.

Privacy policy — what is stored, and the one thing that can ever be sent.

The rest of the project

Live demoThe gatewayThe same boundary as a proxy in front of your own app — watch a document get tokenized on the way out and restored on the way back.ToolLeak RadarDrop a file and see what you'd be handing a cloud LLM. Scanned in your browser; nothing is uploaded.ExplainerHow it worksWhy the boundary is regex and checksums rather than a model — with the check digits worked through, live.NumbersDoes it cost utility?Three real documents, three models, judged blind — what redaction costs an answer, measured rather than guessed.