Mask and the secret preset

Screenshot a request or attach it to a ticket without handing over a live token: values are covered on screen and in every export.

Cover a field of your own

1. Open a request and find the name of the field you must not share, such as x-tenant-key.
2. Click Mask in the toolbar, type that name and press Enter.
3. The value is covered at once, in rows already captured and in the next ones, in the panel and in every export, with no way to reveal it.

Mask matches a field name, not a URL, so /api/ covers nothing. To cover a field in every tracker, add it in Settings → Global patterns → Mask fields named. How patterns match: Patterns: one rule, four places.

What a pattern covers

A mask pattern is a case-insensitive part of a name. It covers the value of:

Where	Matched by
Request and response headers	the header name
Cookies	the cookie name, or a Cookie / Set-Cookie header name; the header is then covered pair by pair, as sid=e•••a; theme=•••, leaving attributes such as Path readable
Form fields and multipart fields	the field name
JSON bodies, request and response	any key on the path to a value: session covers session.id and everything under session
Query and #fragment parameters	the parameter name, in exports only (below)

A covered value reads B•••e: first character, three dots, last character. A value of four characters or fewer reads •••, and an empty value stays empty. The badge Masked: N on the panel's tab strip counts what is covered in the request in front of you; it is hidden at zero.

Response bodies, the ones captured on sites turned on under Bodies and the ones in an imported HAR, are covered by the same patterns as everything else.

The built-in secret preset

From the first request, the preset covers 27 names. Each is a part of a name, so token covers access_token and X-CSRF-Token too:

Kind	Names
Credentials in headers	authorization, cookie, authentication, bearer
Tokens and keys	token, apikey, api-key, api_key, secret, credential, signature, privatekey, private-key, private_key, assertion
Passwords and codes	password, passwd, pwd, passcode, passphrase, otp
Sessions	session, sessid, csrf, xsrf
Signed documents	jwt, saml

Short names that would cover too much are left out on purpose: key, auth, sid, code, pass, id, sig, email. An OAuth ?code= stays readable unless you add code yourself.

Switch the preset off

The Built-in secret preset checkbox sits at the top of the Mask popover, in the tracker only. Untick it to read a token while debugging an auth failure. It is off for this tracker only, and a new tracker always starts covered. While it is off:

• the popover says "Off for this window. Only your own patterns are covered, here and in exports.";
• the Mask button is marked, with the tooltip "The built-in secret preset is off";
• the export dialog warns "The built-in secret preset is off for this window, so only the patterns you wrote are covered.", or, with no pattern of your own, "No mask pattern is active, so nothing in this file will be covered."

The file is safer than the screen

A URL stays readable on screen, in the URL column you scan to find a request, in the Meta tab and in a Location header. The exported file covers what the screen leaves readable:

• a secret in a query parameter, such as …/callback?access_token=eyJ…;
• a fragment shaped like parameters, such as #access_token=…&state=…;
• the redirect target and the Location, Content-Location and Refresh headers.

A covered JSON number or true/false becomes the text "•••" in the file. A Loupewire JSON export and both copies say this in a note, so whoever receives them can tell. The export dialog's Values covered count can be higher than the badge for the same request, because it counts these URL values too.

What masking cannot reach

• A secret in a URL path, such as …/reset/9f2c…: it has no field name to match.
• A value whose name says nothing, such as {"data":"eyJ…"}, unless you name data.
• Text bodies: HTML, XML, plain text, scripts, and a form sent as text/plain. Only form bodies recognised by their type and JSON are read field by field.
• Binary bodies, unnamed multipart parts, and the Meta tab.
• A JSON body too large to list (over 500 values, 12 levels deep, or cut at 64 KiB) is shown as text with covered values masked in place: "Too large, too deeply nested or cut short to list field by field."
• Find searches what is drawn, so a covered value cannot be found by its real text.

Common mistakes

• A URL typed into the Mask list. It matches field names, so nothing is covered.
• Assuming your custom header is covered. The preset knows common names, not yours. The Masked: N badge counts what is covered in the request in front of you.
• Expecting your own header rule to uncover a value. A header you set is still covered if a pattern names it.

Not in this version

A masking report attached to each export, saying which fields were covered and by which pattern, is planned.