Secret & API Key Scanner
Secrets committed to code, pasted into config, or left in log files are a leading cause of breaches. This scanner reads text you paste — source code, a .env file, JSON or YAML config, or logs — and flags likely secrets and API keys: cloud provider keys, access tokens, private-key blocks, connection strings, and high-entropy strings that look like credentials. Matches are masked in the results so you can review findings without re-exposing the raw values.
Because the whole scan runs in your browser, you can check sensitive files without uploading them anywhere — nothing is transmitted or retained. Use it as a quick pre-commit sanity check, when auditing a config before sharing it, or to sweep a log bundle before attaching it to a support ticket. It is a fast first line of defense; treat any match as a prompt to rotate the exposed credential, since a secret that has been committed or shared should be considered compromised.
Paste a config file, .env, or log to flag exposed secrets and API keys. Matched values are masked, and nothing is uploaded — the scan runs entirely in your browser.
Frequently asked questions
- What kinds of secrets does it detect?
- Common API keys and access tokens, private-key blocks, connection strings, and high-entropy strings that resemble credentials, across code, .env, config, and log text.
- Is my pasted text uploaded?
- No. Scanning happens entirely in your browser. Nothing you paste is transmitted or stored, so it is safe to check sensitive files.
- A secret was flagged — what should I do?
- Treat it as compromised and rotate it immediately. Once a credential has been committed or shared, changing it is safer than assuming it stayed private.
- Can it catch every secret?
- No scanner is perfect. It focuses on common, recognizable patterns and high-entropy strings, so use it as a helpful first check rather than a guarantee.
- Why are matches masked?
- Masking lets you see that and where something was found without re-displaying the full secret, reducing the chance of exposing it again on screen.