Confdiff – semantic diff for config files (JSON/YAML/TOML) that redacts secrets
Confdiff is a semantic diffing tool for configuration files that ignores formatting noise and redacts sensitive information like passwords. It supports multiple formats and is designed to help developers see actual changes in data rather than just character-level edits.
Why it matters
It improves security and developer productivity by preventing accidental credential leaks in version control systems.
Semantic, format-aware diff for config & structured-data files. See what actually changed — the meaning, not the text.
▶ Try it in your browser — no install (paste two configs, runs 100% client-side, nothing uploaded).
$ confdiff old.yaml new.yaml ~ env.LOG_LEVEL "info" => "debug" + env.NEW_FLAG = true ~ image "nginx:1.25" => "nginx:1.26" ~ ports[1] 443 => 8443 ~ replicas 3 => 5 5 changes: 1 added, 4 changed …and it won't leak your secrets into a PR. --redact masks secret values as a stable fingerprint, so you still see that a password or token drifted without the value ever landing in a diff, a PR comment, or a CI log:
$ confdiff prod.env staging.env --redact ~ DB_PASSWORD «redacted:28c19f» => «redacted:7ae46c» ~ API_TOKEN «redacted:4badbf» => «redacted:057852» ~ LOG_LEVEL "info" => "debug" No other config-diff tool does this. Jump to Secret-safe diffs →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in