Confdiff provides semantic diffing for config files with secret redaction

Semantic Configuration File Comparison

Confdiff is a new utility designed for comparing configuration and structured data files. Unlike traditional text-based diff tools, confdiff parses files into a data model and compares the underlying data, ensuring that only meaningful changes are reported. This approach eliminates noise from reordered keys, reformatting, changed quoting, or added comments.

Secret Redaction for Enhanced Security

A key feature of confdiff is its ability to redact sensitive information. When comparing files containing secrets like database passwords or API tokens, the tool replaces the actual values with a stable, anonymized fingerprint. This ensures that while users can still see if a secret value has changed, the sensitive data itself is never exposed in diff outputs, pull requests, or CI logs.

Broad Format Support and Cross-Format Diffing

Confdiff supports a wide range of configuration file formats, including JSON, YAML, TOML, INI, .env files, Java .properties files, CSV/TSV, and XML. It automatically detects the format based on file extension and content. The tool also allows for cross-format comparisons, enabling users to diff a configuration file in one format (e.g., JSON) against its equivalent in another format (e.g., YAML) to verify consistency after migration.

Addressing Limitations of Text Diffs

Traditional text diff tools often produce noisy and misleading results for configuration files. They report cosmetic changes as significant, such as key reordering or whitespace adjustments. Confdiff addresses these issues by focusing on semantic differences, providing a clear, single-line output for each actual data change, including the path, old value, and new value.