Free while we’re in preview

Get ClipStudio

Finds credentials in terminal recordings before you share them. Misses one in three.

The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.

One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.

Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.

One file — no installer
Runs on your machine, offline
Source code published below

Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, ClipStudio is included in every plan along with the rest of the range.

A cast file is plaintext. If somebody exported an AWS key on camera, the key is sitting in the file, and often in the recorded command line too.

clipstudio scan --lib ./clips reconstructs each recording’s text stream and reports what it found: detector name, severity, Shannon entropy, the timestamp inside the recording, and a masked excerpt. The credential itself is never printed, in any output mode. redact writes a new cast with every finding replaced by a same-length run of asterisks, then reloads what it wrote and checks that every timestamp token is byte-identical and that a fresh scan comes back clean.

The number you should read twice

On a held-out corpus of credential families it has no named rule for, the measured miss rate is 35%. Seven of twenty. It missed mysql -u root -phunter2Sw0rdf1sh, HTTP Basic auth, curl -u admin:pass, and export DB_PASS=... because “PASS” isn’t in the keyword list.

A redacted clip is safer than the original. It is not certified clean, and this tool will never tell you it is. Watch it before you publish it.

index and search cover the library side, and search runs over the redacted transcript so you can’t pull a secret back out of it.

Reading on the job itself

How to record a terminal session and share it Record the output and its timings rather than the pixels. The result is a fraction of the size, it is text ...

The rest of Screen Studio Lite

What to do with a recording you already have: find the good bits, cut the silences, turn it into a picture, and take the secrets out.

CaptureStudio

Simple Ready

Turns a terminal recording into PNGs and tells you which seconds are worth one.

ScreenFlow

Vertical Ready

Turns a recorded terminal session into a GIF you can paste into a ticket.

RecordDeck

Pro Ready

Cut a nine-minute terminal recording to ninety seconds without re-recording it.

Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams

A working command-line build of the clip library: it indexes a folder of recordings, searches their text, and scans them for credentials with named detectors plus Shannon-entropy analysis, then writes a redacted copy with the timing preserved exactly and re-scans its own output before reporting success. No output path prints a secret in the clear, in any mode. Detection is heuristic and the miss rate was measured on a held-out corpus at 35 per cent, which the notes state plainly. Retention archives by moving files and never deletes.

Naming status

Working name only — brand verdict **AVOID** (Very High). Collision: CLIP STUDIO / Clip Studio Paint. Rename completely.

What it draws on

Existing paid software whose best ideas shaped this program: Bandicam, Snagit, FastStone Capture, Action! Screen Recorder.

Command line

There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.

clipstudio - clip library indexing, secret scanning and redaction
             for SessionForge terminal recordings (Techlosoft Screen Studio Lite)

USAGE
  clipstudio index  --lib <dir> [--index <file.json>] [--json]
  clipstudio list   (--index <file.json> | --lib <dir>) [--json]
  clipstudio search <term> (--index <file.json> | --lib <dir>) [--regexp] [--json]
  clipstudio scan   (<cast.jsonl> ... | --lib <dir>) [--json]
  clipstudio redact <cast.jsonl> --out <file.jsonl> [--force] [--json]
  clipstudio redact --lib <dir> --out-dir <dir> [--force] [--json]
  clipstudio retain --lib <dir> --older-than <age> --ledger <file.jsonl>
                    [--archive <dir>] [--apply] [--json]
  clipstudio help | -h | --help
  clipstudio version

COMMANDS
  index    Walk a library of cast files, parse each header (duration,
           dimensions, recorded-at, title), compute the SHA-256 of every file
           and build a library index. Written to --index if given.
  list     List the indexed clips, sorted by path.
  search   Find clips by term. Matches the recording's TEXT CONTENT as well as
           its filename, title and recorded command. The transcript is redacted
           before matching, so search can never surface a credential.
  scan     Reconstruct each recording's text stream and report the credentials
           in it: detector, severity, entropy, timestamp in the recording and a
           MASKED excerpt. The secret itself is never printed, in any mode.
  redact   Write a NEW cast with every finding replaced by a same-length mask.
           Event timing is byte-for-byte identical, the original file is opened
           read-only, and the output is re-scanned and asserted clean.
  retain   Report which clips a retention policy would archive. Archiving MOVES
           files into an archive directory - nothing is ever deleted. Dry run
           by default; --apply performs the moves. Every run appends one JSON
           line to --ledger.

FLAGS
  --lib <dir>          Clip library directory. *.jsonl and *.cast are indexed;
                       the _archive directory and dot-directories are skipped.
  --index <file.json>  Library index to write (index) or read (list, search).
  --out <file.jsonl>   Redacted output for a single input cast.
  --out-dir <dir>      Redacted output directory for --lib or several inputs.
...

Recorded from the shipped binary, not written by hand.

Windows (amd64) macOS (Apple Silicon) macOS (Intel) Linux (amd64)

Source

Every file the program is built from:

cast.go · console.go · console_test.go · detect.go · guided.go · index.go · main.go · main_test.go · retain.go · scan.go

SHA-256 checksums · build instructions & scope notes · full build plan

ClipStudio

Preview