How to stop pasting API keys and passwords into ChatGPT

Last updated: 4 November 2026

Treat anything you paste into ChatGPT, Claude or Gemini as leaving your company. Remove secrets before you paste, replace them with placeholders, rotate any key that was sent, and use a tool that checks the message in your browser before it is sent.

Why it happens

Most leaks are accidents. You copy a stack trace that holds a connection string, a config file with a token, or a log line with a customer's card number. The chat box accepts it all, and the message is sent the moment you press Enter.

What it can cost

A sent API key must be considered compromised: anyone who can read the conversation can use it until you revoke it.
Conversations can be kept by the service, reviewed for safety, or used to improve models, depending on your plan and settings.
Personal data (e-mail addresses, phone numbers, bank details) falls under the GDPR as soon as it is sent to a third party.

Four habits that prevent it

Replace values with placeholders. Write [API_KEY_1] or [EMAIL_1] instead of the real value. The answer stays useful, because the model only needs the shape of the problem.
Paste the smallest excerpt. The ten lines around an error, not the whole file.
Keep secrets out of the clipboard. Read them from a password manager or environment variables rather than copying them around.
If a key was sent, rotate it. Revoke it at the provider and issue a new one. Deleting the conversation is not enough.

Let the browser check for you

Habits fail on a busy day. PromptKit is a browser extension that checks what you are about to send to ChatGPT, Claude and Gemini, on your device. It blocks API keys, private keys, card numbers, passwords, IBANs and social security numbers by default, and warns about e-mail addresses and phone numbers. One click replaces each value with a numbered placeholder, so you can still send the question. It has no server and makes no network request.

Try the demo on the home page or see everything it does.

Limits to keep in mind

Pattern-based detection cannot recognize every secret. It does not read images or PDFs, and it does not cover other apps or API calls. Use it as a safety net, not as your only safeguard.