Stop leaking secrets
in your logs
Scan log streams for AWS keys, passwords, tokens, and 700+ other patterns. Up to 5M lines/sec with AVX2 SIMD on AMD Ryzen. Free for open-source and non-commercial use.
Three-phase detection pipeline
SSE 4.2 hardware pre-filter rejects clean lines instantly. Aho-Corasick scans survivors in a single pass. PCRE2 JIT only fires on the ~5% with a hit.
In real-world logs (~3% secrets), the SSE 4.2 filter skips 97% of lines before they reach Aho-Corasick
Built for production
No compromises on speed, safety, or simplicity.
O(n) Multi-Pattern
Aho-Corasick DFA scans for all 793 patterns in a single pass. Linear time regardless of pattern count.
AVX2 + SSE 4.2 SIMD
Hardware-accelerated byte scanning and line pre-filtering. Optimized for AMD Ryzen, works on any x86-64.
Zero Allocations
Arena allocator via mmap. No malloc, no free, no GC in the processing hot path.
ReDoS Protected
Match limits on every regex. No catastrophic backtracking, even with adversarial input.
Pipeline Native
stdin to stdout. Works with tail -f, docker logs, kubectl, Fluentd, Vector, Logstash.
3 Ways to Use
Native C binary for max speed. Python package via pip. REST API for testing and prototyping.
793 detection patterns
12 categories + 4 compliance profiles (HIPAA, PCI, GDPR, SOC2). Load all, or pick what you need.
Real benchmarks, real numbers
Tested on AMD Ryzen 5 5600X (6C/12T). Real-world workload: 1M log lines, 3% contain secrets.
Default (14 patterns)
FASTESTAWS, GitHub, email, IP, JWT, passwords — covers 90% of use cases
Full scan (702 patterns)
ALL PATTERNSEvery cloud, payment, VCS, infra, PII, and auth pattern loaded
AVX2 SIMD, SSE 4.2, AMD Ryzen optimized. For maximum throughput.
Same C engine via ctypes. Bulk API for max throughput. pip install plumbrc.
Network latency is the bottleneck. Best for testing and prototyping.
REST API
Send text, get clean text back. Sub-millisecond processing on the server.
curl -X POST https://plumbr.ca/api/redact \
-H "Content-Type: application/json" \
-d '{"text": "key=AKIAIOSFODNN7EXAMPL3"}'
# Response:
{
"redacted": "key=[REDACTED:aws_access_key]",
"stats": {
"lines_modified": 1,
"patterns_matched": 1,
"processing_time_ms": 0.066
}
}Honest note: The server processes each request in ~0.1ms, but network round-trip adds 100-800ms depending on your location. For production throughput, use the native C binary or Python package — both run locally with zero network overhead.
Python Package
pip install and start redacting in seconds.
pip install plumbrc
from plumbrc import Plumbr
# Initialize
p = Plumbr()
# Redact secrets
safe = p.redact("password=secret123")
print(safe) # "[REDACTED:password]"
# Batch processing
lines = ["api_key=secret", "normal log", "token=xyz"]
safe_lines = p.redact_lines(lines)
# Context manager
with Plumbr() as p:
safe = p.redact("AWS_KEY=AKIAIOSFODNN7EXAMPLE")
# Get statistics
print(p.pattern_count) # 14
print(p.stats) # {'lines_processed': 1, ...}Ready to ship clean logs?
Try in the browser, install via pip, or integrate the API.