Porthole
Sharing a session

Credential masking

Redact secrets from terminal output before it reaches the viewer.

porthole host --mask

With --mask, output is rewritten before it leaves your machine. Your own terminal is unchanged; only what the viewer receives is redacted.

You see:     export GITHUB_TOKEN=ghp_16C7e42F292c6912E7710c838347Ae178B4a
Viewer sees: export GITHUB_TOKEN=[redacted:github_token]

What it recognises

Out of the box: AWS keys, GitHub and GitLab tokens, OpenAI and Anthropic keys, Stripe, Slack, Google, SendGrid and npm tokens, JWTs, private-key headers, passwords inside connection strings, and high-entropy values assigned to secret-sounding names.

Adding your own patterns

porthole host --mask-pattern 'ACME-[0-9]{8}'

--mask-pattern implies --mask, and is repeatable. To run only your patterns and switch the built-in rules off:

porthole host --mask --mask-pattern 'ACME-[0-9]{8}' --mask-no-auto

Redaction happens before buffering

Output is redacted at the point it is produced, not at the point it is sent. That matters for reconnection: the replay buffer a viewer receives when they rejoin holds already-masked text, so a credential cannot reappear when someone comes back.

The session summary

When the session ends, Porthole prints what it redacted and how often:

  🔒 4 secrets masked from the viewer this session
     github_token ×2, aws_access_key ×1, jwt ×1

This is worth reading. If it says zero and you expected otherwise, the rules did not match what you thought they would.

Best-effort, by construction

Masking is defence in depth, not a guarantee. It catches routine accidents — cat .env, an echoed token, a stack trace containing a connection string — but it cannot stop a determined attempt to exfiltrate a secret, it cannot see values assembled only on the rendered screen, and it will miss credentials with no recognisable shape.

Treat it as lowering the cost of a mistake, not as a reason to share a terminal you otherwise would not.

porthole probe masks its report by default for the same reason — a diagnostics file is meant to be pasted into an issue tracker. See Diagnostics.

On this page