How to Redact PII Span Attributes and Bearer Tokens from OpenTelemetry OTLP JSON Traces in Local RAM

Description and use

The tool removes tokens, SQL literals, GenAI prompts, and internal IPs from OpenTelemetry traces while preserving trace hierarchy, enabling secure local analysis.

Problem

Exported OpenTelemetry OTLP/JSON trace files often contain production secrets and regulated customer PII in span attributes, exposing sensitive data when shared or formatted in the cloud.

Outcome

The tool removes bearer tokens, SQL literals, GenAI prompts, and internal IPs from OTLP traces while keeping trace structure intact, allowing secure local analysis and sharing.

Workflow

• 1. Load the OTLP/JSON trace file into the OpenTelemetry Trace Redactor browser studio or standalone offline PRO workstation.
• 2. Select a redaction strictness level (35% Partial Trace ID Mask, 70% Standard Span Attribute Mask, or 95% SOC2 & GDPR Safe Harbor Scrub).
• 3. The redaction engine applies a regex pattern to target sensitive attribute values while preserving spanId links.
• 4. Review the sanitized trace in the 12‑column free workbench; copy or download the first 70% of sanitized span records for free.
• 5. For air‑gapped teams, use the standalone offline PRO workstation compiled as a single‑file HTML5 application to scrub traces without internet access.

Evidence

Pasting an OTLP JSON trace dump into a cloud formatter or attaching it unredacted to a support ticket exposes production authentication tokens and customer PII outside your security boundary.

Source

Instead of corrupting the JSON structure or breaking parent-child spanId links, the local redaction engine targets sensitive attribute values while preserving trace hierarchy.

Source