Secret scanner — find API keys and tokens in code
Paste code or logs and find leaked API keys, tokens and private keys before you share them. It scans entirely in your browser (0 uploads, works offline) — which is the only safe way to check something for secrets.
How to use it
- Enter or paste your input above.
- The result appears live on your device.
- Copy or Download it.
FAQ
How do I scan code for leaked secrets for free?
Paste the code or logs and this page flags anything that looks like an AWS key, GitHub token, Stripe key, private key or generic secret — matched by shape, on your device, with no upload. Findings are masked and tagged by severity.
Is it safe to paste code that might contain secrets?
Yes — the scan runs entirely in your browser and nothing is transmitted or stored, which you can verify by turning off your Wi-Fi. That is exactly why a secret scanner must be client-side: uploading code to check it for secrets would defeat the purpose.
Does a match mean the secret is compromised?
No — the patterns match the shape of a secret, not its validity. Treat a match as a prompt to check and rotate; a real key that appears here should be rotated regardless.
Can it miss secrets?
Yes — it covers common high-signal patterns, not every possible secret format. A clean result is reassuring, not a guarantee.
Limits
Pattern-based detection of common secret formats; it cannot confirm a secret is live and may miss unusual formats.
Related
The PII detector finds personal data; the hash and HMAC tools handle cryptographic values.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.