End user

User Guide

Maskink stands between you and the AI: every message you write on the Chat screen is sent to the AI only after its sensitive information (IPs, server names, usernames, passwords, keys…) has been replaced with consistent placeholders; the reply is automatically restored to the real values. On the Mask screen you can mask a text by hand and copy it to another AI tool.

Administrator guide →

01Chat

The Chat screen (the first tab in the top menu) lets you talk safely to the AI models you have connected. You write with the real values; the AI only sees the masked version.

1. You write. Type your question; paste logs, scripts or configuration as they are.
2. Maskink masks. The message is masked on the server; only tokens such as <IP_1> and <USER_1> reach the AI.
3. The AI replies. The model uses the same tokens in its reply and in the commands it suggests.
4. The reply is restored. Tokens are turned back into the real values in your browser, so you can copy and use the commands directly.

I cannot connect to web01.acme.local (10.20.30.40)
with ssh admin@10.20.30.40.

I cannot connect to <FQDN_1> (<IP_1>)
with ssh <USER_1>@<IP_1>.

If the model writes ssh -vvv <USER_1>@<IP_1> in its reply, you see ssh -vvv admin@10.20.30.40 on screen. Restored values are highlighted in their category color; hover over one to see which token the AI saw.

Consistent tokens throughout a chat

A value keeps the token it got in the first message in every later message of the chat. Even if you later write a previously masked value without context (e.g. first web01.acme.local, then just web01), it is recognized and masked. This way the AI never loses track of "which server, which user" during the chat.

02The chat screen

Choosing a model

The Model list at the top shows the models available on the configured AI connections. The number next to a model is its context length (e.g. 128K): how long a chat and how much log it can take. Your choice is remembered per chat. If the list is out of date, press the refresh button next to it.

• Large general-purpose models are a good default for analysis and explanations.
• Coder models are better for writing scripts and fixing code.
• Smaller models answer faster. Models marked · vision in the list can also see screenshots.

Some models “think” before they answer. That reasoning is shown above the reply in a collapsible Reasoning section; it is restored to the real values as well.

Writing a message

• Enter sends the message, Shift + Enter starts a new line.
• File: Adds the contents of a text file to the message; you can also drag and drop the file onto the input area. Image files are added as screenshots. At most 4,096 KB can be sent in one message.
• Preview before sending: When checked, pressing send shows the masked text that will go to the AI; check it and choose Send or Cancel.
• Stop: Interrupts the stream while a reply is coming in; what has arrived so far is kept.

Below a sent message you see how many values were masked (4 values masked). Masked values in the message are highlighted; hover to see which token went to the AI. If a risky word such as password or token appears on a line where nothing was masked, a risk warning is shown.

Reply buttons

• Copy: Copies the reply with the real values.
• Copy masked: Copies the reply with its tokens (e.g. to share it with someone).
• Regenerate: Deletes the last reply and asks the same question again.
• Copy at the top right of code blocks copies the command with the real values.

The model name, the duration and the number of tokens used are shown below the reply. If the model invents a token that is not in the mapping (e.g. an <IP_9> that never appeared), it is underlined with a dashed yellow line and a warning is shown; that value cannot be restored.

What the AI sees

If you check What the AI sees at the top right, the whole chat is shown as it was sent to and received from the AI, that is, with tokens. Use it to check what was hidden; uncheck it to return to the real values.

Mapping

The Mapping button lists which token stands for which real value in this chat; the number next to it is the count of distinct masked values. A file saved with Download JSON can also be loaded on the Restore tab of the Mask screen.

Chat list

Your earlier chats are in the list on the left. New chat opens an empty chat; every chat has its own mapping table, so tokens are not shared between chats. Hover over a chat and use the trash icon to delete it. On narrow screens the list opens with the menu button in the top bar.

03Adding screenshots

You can also ask about an error screen, a table or console output as a screenshot. Before the image goes to the AI, the sensitive text in it is covered.

1. Add it. Paste the screenshot into the input area with Ctrl + V, drag and drop it, or choose it with File. Up to 4 images can be added to a message.
2. The image is read. The text in the image is read twice on your own computer (OCR): once with the page layout and once for scattered text such as table cells. The image is not sent anywhere for this. On first use, loading the OCR files can take a few seconds.
3. It is covered. The text that was read is masked with the Maskink rules and each masked value is covered with its token (e.g. <IP_1> is written where the IP address was). Cells in table columns with headers such as User, Username, Account, Server, Host, Display Name are masked even without context next to them.
4. Check and correct. The window that opens shows the image that will be sent to the AI (see the table below).
5. Choose Add to message, then write your question and send it. Before sending, you can reopen the window with Edit on the attachment card.

Words with a dashed orange frame need your attention: words that could not be read reliably, or that look like a username / server name (j.doe, svc_backup, admin01) but were not masked. Click to mask them if needed, or choose Cover orange-marked words with boxes.

The AI receives both the covered image and the masked version of the text read from it. If its reply says <IP_1>, you see the real IP address. The same value in your message and in the image gets the same token.

• Vision-capable models (marked · vision in the list) see the image; they can also interpret the table layout, colors and icons.
• Other models do not receive the image; only the text read from it is sent, masked. The attachment card tells you so.
• The image stays in your sent message; click it to enlarge. The What the AI sees checkbox at the top right switches images just like text: unchecked shows the original image, checked shows the covered version. In the enlarged view you can also switch with Show original. The Text read from the image section shows the text that was read.

04How chats are stored

• Chats and mapping tables are stored only on the computer you use, in that browser. They are not saved on the server or in the database.
• When you sign in from another computer or another browser your chats are not visible; nobody else can see your chats either.
• Chats opened in a private (InPrivate/incognito) window are deleted when the window closes. Clearing the browser's site data also deletes the chats.
• Both the original and the covered version of your screenshots are stored only in this browser, like the texts with real values; only the covered version goes to the AI. If the browser storage fills up, the original images of the oldest chats are deleted first, then the covered images; text and mappings are kept.
• Messages are held in memory only while they pass from the server to the AI. The text sent to the AI contains no real values.

05Mask: quick start

The Mask screen is for masking a text without sending it to the chat: you can copy the masked output to another AI tool or a ticket, and restore the reply here as well.

1. Open the Mask page from the top menu.
2. Paste the log or script into the Input area on the left, or drag and drop the file onto it.
3. Press Mask (shortcut: Ctrl + Enter).
4. Check the Masked tab on the right for any value that was missed.
5. Give the output to the AI with Copy or Mapping ▾ → Copy with an AI explanation.
6. Paste the AI's reply into the Restore tab to turn the tokens back into the real values.

Nov  2 09:14:07 web01 sshd[2211]: Accepted password for john.smith from 10.20.30.40 port 52144
mysql -u app_user -p'S3cr3t!2024' -h db01.corp.local

Nov  2 09:14:07 <HOST_1> sshd[2211]: Accepted password for <USER_1> from <IP_1> port 52144
mysql -u <USER_2> -p'<PASS_1>' -h <FQDN_1>

The same value is replaced with the same token everywhere in the text: even if web01 appears a hundred times, it is always <HOST_1>. This lets the AI work out "what happened on which server".

06Loading text

• Paste: Paste the content directly into the Input area.
• Open file: You can choose .log, .txt, .sh, .ps1, .py, .conf, .cfg, .ini, .json, .xml, .yml, .csv, .env, .sql and similar text files.
• Drag and drop: Drop the file onto the Input area.
• Character encoding: UTF-8, UTF-16 (Windows event exports) and Turkish Windows-1254 files are detected automatically; non-ASCII characters are preserved.
• Sample: Loads ready-made, made-up samples to try the tool (mixed log, bash, PowerShell, switch/router configuration).
• Clear: Deletes the input and the results.

At most 4,096 KB of text can be masked at once. Split larger files into parts.

07Mode and options

Mode: Automatic / Log / Script

Some rules only make sense for a particular kind of content. For example, in script mode code expressions such as $user.Name are not taken for usernames, while in log mode the server name in the syslog header is caught.

• Automatic: Maskink guesses from the line structure whether the content is a log or a script. Use this in most cases.
• Log: For server, firewall, switch, NAC and application logs.
• Script: For bash, PowerShell, Python and similar code/configuration files.

The mode that was used is shown as Mode: in the statistics line below the output.

Categories to mask in this run

Open this section below the Input area to turn off some categories for the current run. For example, when analyzing a network problem you may want to leave IP addresses visible. Your choice is remembered in your browser.

Live

When checked, the output updates by itself shortly after you type or paste.

Propagation

When a value is found through its context (e.g. user=john), the same value is also masked where it appears elsewhere in the text without context (e.g. john logged in). It is on by default and should stay on.

08What gets masked?

Maskink recognizes the categories below. The token format can be changed by your administrator; the table shows the current settings of this installation.

Examples of what is recognized:

• Passwords: password="…", pwd=…, -p'…', ConvertTo-SecureString "…", sshpass -p, user:password@ in URLs, Cisco enable secret, SNMP communities, /etc/shadow hashes…
• Keys: PEM/SSH private key blocks, JWTs, AWS/GitHub/Slack and similar token patterns, Authorization: Bearer …, cookies, high-entropy secret values.
• Users: the first.last pattern, CORP\user, user@host, account names in Windows event logs, C:\Users\… and /home/… paths.
• Network: IPv4/IPv6, MAC, FQDNs, server names in URLs, UNC paths (\\server\share), LDAP DNs.
• Personal data: full names, e-mail, phone numbers, checksum-verified Turkish ID numbers (TCKN), IBANs and card numbers.

If server, project or customer names specific to your organization cannot be recognized by a pattern, your administrator can add them to the Custom dictionary.

09Output tabs

Masked

This is the text to give to the AI. Tokens are shown in their category color; clicking a token highlights it everywhere in the text.

Highlighted original

Shows the original text with the masked parts highlighted. Use it to check what was masked and what was missed.

Mapping table

Lists which real value each token stands for, how many times it occurs and which rule found it. Original values are blurred by default; check Show original values to see them. You can search by token, category or rule name.

Restore

Paste the AI's tokenized reply here and press Restore; the tokens are turned back into the real values using the current mapping table. If you closed the page, you can also restore by loading a mapping JSON file you downloaded earlier with Load mapping JSON. Everything happens in your browser.

Top buttons

• Copy: Copies the masked text to the clipboard.
• Download: Downloads the masked text as a file.
• Mapping ▾ → Download JSON / CSV: Saves the mapping table. This file contains the real values; keep it somewhere safe and do not share it with anyone or with the AI.
• Mapping ▾ → Copy with an AI explanation: Copies the masked text with a short note at the top that tells the AI what the tokens mean and that it must keep them unchanged. No real values are included.

10Working with an AI

1. Mask the text and review the Masked tab.
2. Choose Mapping ▾ → Copy with an AI explanation and paste it into the AI together with your question.
3. The AI will use tokens such as <HOST_1> and <USER_2> in its reply.
4. Paste the reply (e.g. the suggested commands) into the Restore tab; it becomes usable with the real values.

11Warnings and statistics

If a sensitive keyword such as password, secret or token appears on a line but nothing on that line was masked, a yellow warning appears above the output. Click the line number to jump to that line. This suggests a value may have been missed; always check the line and report it to your administrator if needed.

The statistics line below the output shows the detected mode, the unique values and occurrences per category, the total number of matches and the processing time. Click a category to filter the mapping table by it.

12Privacy

• The text you mask is not stored on the server; it is only kept in memory while it is processed.
• On the Mask screen the mapping table (token → real value) stays only in the open browser page; it is deleted when you close the page. For how the Chat screen stores data, see How chats are stored.
• If the administrator has enabled statistics, only numeric information (character count, match count, duration) is recorded; content is never recorded.
• Your browser only remembers your preferences (mode, Live, Propagation, the categories you turned off, the interface language).

13Good practices

• Always review. Maskink is an automatic helper and does not give a hundred percent guarantee. Take a quick look at the Masked output before sending.
• Do not send more than needed. Pick the lines related to the problem; take the relevant time range instead of the whole log file.
• Protect mapping files. JSON/CSV mapping files contain the real data; delete them when you are done.
• Report what was missed. If you see an unmasked password, server name or organization term, report it to your administrator with a sample line (with the real value changed); a rule can be added.
• Mind your screen. Do not share your screen while the highlighted original or the mapping table is open.

14Frequently asked questions

Can I see my chat from another computer?

No. Chats are stored only in the browser of the computer you wrote them on. To keep a reply, copy it with Copy and add it to your own notes.

I still see tokens like <IP_1> in the AI's reply in the chat.

If the model wrote a token incorrectly (e.g. with an extra space) or invented a number that is not in the mapping, it cannot be restored; such tokens are highlighted in yellow. Try Regenerate or remind the model to “use the placeholders exactly as they are”. Also make sure What the AI sees is not checked.

The model list is empty or says “Could not load the model list”.

The AI service may be unreachable at the moment. Press the refresh button next to the model list after a few minutes; if the problem persists, tell your administrator.

The reply stopped halfway.

In long chats the model's context limit may fill up. Open a New chat and ask again with only the necessary information, or choose a model with a longer context.

A value was not masked. What should I do?

First make sure its category is enabled under "Categories to mask in this run" and that you chose the right mode. If the value is still not masked, change it by hand before sending and tell your administrator.

Something that should not be masked was masked.

If you need it for analysis, you can turn off that category for the run. If it happens often (e.g. internal IP ranges, localhost), your administrator can add it to a permanent exception list.

Are the numbers in tokens always the same?

Numbers are consistent within one run, but may change when you mask a different text again. If your administrator set the token format to use {hash}, the same value always gets the same token.

The AI changed the tokens and restoring does not work.

Restoring only works when the tokens are kept exactly. Tell the AI not to change the tokens; Copy with an AI explanation says this automatically.

I refreshed the page and the mapping is gone.

For security, the mapping is kept only in the page. If you downloaded a mapping JSON file earlier you can load it on the Restore tab; otherwise mask the same input again.