Confdiff offers semantic JSON, YAML and TOML diffs with fingerprinted secret redaction

What confdiff does

A new command-line tool called confdiff has surfaced on Hacker News's front page, taking aim at one of the more tedious corners of software work: reviewing changes to configuration files. According to the project's GitHub README, confdiff is a diff tool that compares the meaning of config files rather than their text. Instead of working line by line the way git diff does, it parses each file into a data model and compares that model, so cosmetic churn — reordered keys, changed indentation, added comments, different quoting styles — is not reported as a change. Only real differences in keys and values are.

Eight formats are supported: JSON, YAML, TOML, INI, .env, Java .properties, CSV/TSV and XML (including .svg and .plist). The format is detected from the file extension, with content sniffing as a fallback. confdiff can also compare across formats, so a config. can be checked against the config.yaml it was migrated to, in order to confirm the two are equivalent.

Redaction keeps secrets out of logs

The headline feature is secret-safe diffing. With the --redact flag, values identified as passwords, tokens or API keys are replaced in the output by a short, stable fingerprint (for example «redacted:28c19f»). When a secret changes between two files, the fingerprints differ, so a reviewer can see that a credential drifted without the actual value ever appearing in a pull request comment, a chat thread or a CI log. Additional paths can be covered with --redact-key globs. The README claims no other config-diff tool offers this, and the project's own comparison table lists rivals diffx, difftastic, dyff and jd without redaction support.

Catches that text diffs miss

Semantic comparison also surfaces bugs that a text diff actively hides. A value changing from the number 80 to the string "80" looks identical in a text diff; confdiff flags it as a type change. Large integers beyond 2^53 — the README cites Discord and Twitter "snowflake" IDs — are compared exactly instead of collapsing into floating point, which the project says avoids false "no differences" results in tools that parse everything to a float. YAML anchor merge keys are resolved to their effective content before diffing.

Kubernetes users get multi-document YAML support: files with --- separators, such as Helm renders or kubectl output, are split into documents and compared per document rather than failing to parse. CSV and TSV rows can be compared positionally or matched by a key column with --csv-key, so reordered rows do not drown out the one cell that actually changed. A loose mode treats "3" and 3 as equal, which suits .env and INI files where every value is a string. Path globs let reviewers silence volatile fields like metadata.* or focus on a single subtree, and --array-set compares arrays as unordered sets when order does not matter.

For automation, the tool exits with code 0 when files are identical, 1 when differences exist and 2 on error, and it can emit machine-readable JSON output. It can also be registered as a git diff driver, so git diff on tracked config files shows semantic output instead of raw text changes.

Availability

confdiff installs through npm and needs Node.js 18 or newer; it can also run without a permanent install via npx, or through a container image published on GitHub Container Registry, with v0.10.0 given as an example of a pinned version tag. A browser version on the project page runs entirely client-side, so configurations pasted into it are not uploaded anywhere.

A project maintained by an AI agent

One unusual footnote: according to the README, the project is built and maintained by an autonomous AI agent named Esperanza Volkov, which reads and acts on issues and pull requests itself. Users are asked to open issues whenever something looks off, since that feedback is described as the main way the agent improves.

Why it matters

Config reviews are where text diffs fail loudest. Reformatting a YAML file can generate hundreds of lines of noise, training reviewers to skim past changes — exactly the moment a rotated database password or a bumped replica count slips through. A tool that reports only meaningful changes, and that can keep secret values out of diffs and logs as stable fingerprints, slots directly into code review and CI pipelines. Cross-format comparison also addresses the common migration problem of proving a JSON-to-YAML conversion preserved its meaning. The AI-maintained governance model is unproven, so teams may want to vet the tool before relying on it, but the feature set targets a genuine gap, particularly for Node.js-based workflows.