Security guides
How to share logs without leaking tokens, hostnames and personal data
Logs are copied into tickets, chats and vendor portals. A few minutes of redaction and a short-lived encrypted paste prevent the most common leak.
Updated · 5 min · Free, no account required
A log is rarely just a log. It can contain bearer tokens, cookies, internal hostnames, email addresses, database URLs and the names of customers. The person asking for it usually needs the shape of the failure, not the secrets around it.
Time: 5 minutes · Cost: free · Account: not required
Step by step
-
1
Collect only the relevant window
Take the smallest time range and the fewest lines that still show the failure. A full day of logs is usually unnecessary and increases the chance of including unrelated personal data.
-
2
Replace secrets before you copy
Replace bearer tokens, cookies, API keys, passwords and connection strings with placeholders such as [REDACTED_TOKEN]. Keep the prefix and length if they matter for diagnosis.
-
3
Remove or generalise identifiers
Replace email addresses, customer names, account numbers and internal hostnames with stable placeholders. Keep the pattern if the request depends on it.
-
4
Put the log in a private paste with an expiry
Use a text paste rather than a public file host. Set an expiry that matches the support conversation and add a password when the log is shared outside the team.
-
5
Send the link and the password separately
The link can go in the ticket; the password can go in a direct message or a call. This prevents a forwarded ticket from exposing both halves.
-
6
Delete the paste when the issue is resolved
Use the manage link to delete it early. Do not wait for the timer if the diagnostic is no longer needed.
The fields that leak most often
Authorization headers, cookies, query strings with tokens, connection strings, signed URLs and request bodies are the usual suspects. Internal hostnames and IP addresses reveal architecture; email addresses and user identifiers create privacy obligations.
A simple search for words such as authorization, bearer, token, password, secret, cookie and session catches many of them. It is not a complete audit, but it removes the obvious mistakes.
Public pastebins and search engines
Public paste hosts can be indexed, archived and copied. Deleting the original does not remove third-party copies. A private paste with an expiry is a better default for a diagnostic that contains anything specific to your system.
If the log is genuinely public and useful to others, publish it through a channel you control and review it as carefully as a blog post.
What to tell the person receiving the log
Say what was redacted and why. If a placeholder hides a value that matters, describe its shape instead of restoring the secret. A good handoff gives the recipient enough to reproduce the problem without giving them access to production.
Frequently asked questions
Can I paste a log into a public pastebin?
Only if you have reviewed it and are comfortable with it being public, indexed and copied. Logs often contain tokens or personal data, so a private expiring paste is the safer default.
What should I redact from a stack trace?
Authorization headers, cookies, API keys, connection strings, email addresses, customer identifiers and internal hostnames. Keep the format and enough surrounding lines to reproduce the error.
Does an expiry make a public paste safe?
It limits the window, but public pastes can be copied immediately. Expiry is not access control. Use a password and browser encryption when the content is sensitive.
How long should a shared log stay online?
No longer than the support conversation needs. Set a short expiry and delete the paste with the manage link when the issue is resolved.
Related reading
Share a password safely
A step-by-step method for sending a password or credential so it expires, can be read once, and never sits in a mailbox or chat history.
Read morePasteOkay vs transfer.sh
transfer.sh shares files from the command line with a simple curl command. We compare its retention, encryption and terminal workflow with PasteOkay.
Read morePasteOkay vs Pastebin.com
Pastebin.com is the best known paste service. We compare its expiry rules, ads, public archive and privacy model with PasteOkay's encrypted, account-free editor.
Read morePut the guide into practice
Create a paste, choose a short expiry and add a password. No account, no public feed and no third party scripts.