diff --git a/service/internal/reports/parse.go b/service/internal/reports/parse.go
index 248d5e27..064f210e 100644
--- a/service/internal/reports/parse.go
+++ b/service/internal/reports/parse.go
@@ -418,7 +418,7 @@ func textIdentifiers(text string) []Identifier {
 	var out []Identifier
 	seen := map[string]int{}
 	add := func(name, v string) {
-		if (name == "cloud_id" && !strings.ContainsAny(v, "0123456789")) || zeroish(v) {
+		if (name == "cloud_id" && !strings.ContainsAny(v, "0123456789")) || !alnum.MatchString(v) || zeroish(v) {
 			return
 		}
 		k := strings.ToLower(v)
@@ -453,6 +453,11 @@ func textIdentifiers(text string) []Identifier {
 	return out
 }
 
+// alnum: a value with a letter or a digit in it. One a sender masked by hand
+// ("CloudCryNum" : "#######") is no identifier, and replacing it would take
+// every run of #s in the log with it (r-7tb674nu).
+var alnum = regexp.MustCompile(`[A-Za-z0-9]`)
+
 func countFold(text, v string) int {
 	return strings.Count(strings.ToLower(text), strings.ToLower(v))
 }
diff --git a/service/internal/reports/parse_test.go b/service/internal/reports/parse_test.go
index 288e2ded..f66922aa 100644
--- a/service/internal/reports/parse_test.go
+++ b/service/internal/reports/parse_test.go
@@ -290,3 +290,13 @@ func TestIpctoolsShortCloudIDAndTheLogsSerialAreOne(t *testing.T) {
 		t.Errorf("redacted:\n%s", got)
 	}
 }
+
+// A value its sender masked by hand is no identifier: the #s it was masked
+// with stay, and so do the log's other runs of them.
+func TestAValueMaskedByHandIsLeftAlone(t *testing.T) {
+	log := `{ "CloudCryNum" : "#######", "DevInfo" : { "Data" : "*********", "Key" : "31415926" } }` + "\n####### boot #######\n"
+	got := Redact(log, Facts{}, "k")
+	if strings.Count(got, "#######") != 3 || !strings.Contains(got, `"*********"`) || strings.Contains(got, "31415926") {
+		t.Errorf("redacted:\n%s", got)
+	}
+}