Clearing sensitive data when sharing database dumps

Last updated: June 11, 2025

Usage

None of these commands will sanitize or wipe any custom content-type sensitive data, you should review all of your content-types to ensure any other data is safe to provide.

Usage of these scripts should not be performed on any application you use regularly, it should be performed after the dump in an isolated environment. The Strapi team will only request this as part of certain debug actions or during technical audits

PostgreSQL

The following SQL command are for PostgreSQL and are designed to clear or sanitize the following data:

  • Reset all API Token values to a generic value (abc123)

  • Reset all Transfer Token values to a generic value (abc123)

  • Delete all Users-Permissions Users and their links to any roles

  • Delete any custom 3rd party authentication config data for Users-Permissions

  • Reset all Admin Panel user passwords to "Test1234!"

Strapi 5

update strapi_api_tokens set access_key = 'abc123' where access_key is not null;
update strapi_transfer_tokens set access_key = 'abc123' where access_key is not null;
delete from up_users where "email" is not null;
delete from up_users_role_lnk where "id" is not null;
delete from strapi_core_store_settings where "key" like 'plugin_users-permissions_grant';
-- This token is the hashed version of "Test1234!"
update admin_users set "password" = '$2a$10$ReHihhN/VAlGZPt5CKeMeOX4GEZEzyKn4kOWjNCr2SD1tLDdW9vly' where "password" is not null;

Strapi 4

update strapi_api_tokens set access_key = 'abc123' where access_key is not null;
-- Transfer token table will only exist on Strapi 4 applications above v4.10.0
update strapi_transfer_tokens set access_key = 'abc123' where access_key is not null;
delete from up_users where "email" is not null;
delete from up_users_role_links where "id" is not null;
delete from strapi_core_store_settings where "key" like 'plugin_users-permissions_grant';
-- This token is the hashed version of "Test1234!"
update admin_users set "password" = '$2a$10$ReHihhN/VAlGZPt5CKeMeOX4GEZEzyKn4kOWjNCr2SD1tLDdW9vly' where "password" is not null;

MySQL/MariaDB

Coming Soon

SQLite

Coming Soon