Does sensitive = true encrypt a value in Terraform state?
No. Sensitive metadata controls presentation in supported Terraform output, but state can still contain the value in plaintext. State storage and access must be secured separately.
Terraform State Inspector & Secret Scanner
Map resources, modules, providers, outputs, and possible secrets in terraform.tfstate; export a separate redacted copy for review or support.
Inspect a Terraform state file
DecodeLens parses raw terraform.tfstate and terraform show -json state output in a browser worker. It never contacts Terraform Cloud, a backend, provider, or managed resource.
Terraform state JSON
Terraform state analysis
State metadata, module-aware resources, outputs, credential findings, and the separate redacted copy will appear here.
Module-aware Terraform state inspection
DecodeLens groups resources by module, distinguishes managed resources from data sources, exposes provider and attribute paths, and correlates each possible credential with its exact state location.
State and redaction boundaries
- Supports raw JSON terraform.tfstate v4 and the values representation produced by terraform show -json for state files.
- The inspector does not open a backend, refresh infrastructure, execute a provider, resolve references, or modify the original file.
- Terraform sensitive metadata is used as strong evidence, but plaintext values may still be present in state.
- Known names and credential formats are higher-confidence findings; entropy is deliberately conservative and remains optional for redaction.
- The exported JSON is a review artifact, not a valid operational state replacement. Always inspect it before sharing.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Cloud & DevOps
Kubeconfig Inspector & Sanitizer
Map Kubernetes contexts, clusters, users, certificates, and authentication methods; detect risky settings and export a separate redacted copy.
Open tool - Security & identity
Kubernetes Secret Decoder & Inspector
Decode Kubernetes Secret values, inspect nested credential and file formats, or build a masked-by-default YAML/JSON manifest locally.
Open tool - Data formats
JSON Formatter & Validator
Format, minify, validate, and explore JSON in a collapsible Object View without uploading data.
Open tool - API & network
HAR File Analyzer & Sanitizer
Analyze HAR requests, failures, timing, transfer sizes, bodies, and sensitive fields; export a separate redacted copy.
Open tool
Review terraform.tfstate before sharing it
Load the example, locate the database password and token findings, search the module tree, then inspect the stable placeholders in the separate redacted JSON.
State attribute
module.application.kubernetes_secret.application["api"].data.API_TOKENShare-only copy
"API_TOKEN": "[REDACTED_TOKEN_1]"Terraform State Inspector FAQ
Can I run terraform apply with the redacted download?
No. Replacing values changes the state data. The download is only a non-operational copy for review, debugging, or support conversations.
Does the scanner guarantee that every secret is removed?
No. It covers Terraform sensitive metadata, common field names, known credential formats, and conservative entropy signals. Provider-specific or custom structures still require manual review.