Secret Scanner
Paste a .env file, a log, a config or a code snippet. The Secret Scanner finds API keys, tokens, private keys and database passwords from 40 providers, says what each one unlocks and how to revoke it, and gives you a redacted copy that is safe to share.
Your text never leaves this tab. The scanner does not test keys against providers, since that would send them off your device.
How the secret scanner works
Most providers now put a fixed prefix on their keys, such as ghp_ for GitHub, sk_live_ for Stripe or AKIA for AWS, so a leaked key can be matched by its shape alone. The scanner checks each line against 40 of these formats, plus private key blocks, JSON Web Tokens, database URLs with a password, and a generic rule for random-looking values assigned to names like token, secret or password.
- Each finding names the provider, what the key unlocks, the line it sits on, and where to revoke it.
- Placeholders such as AWS's documented AKIAIOSFODNN7EXAMPLE, xxxx, changeme or your_key are listed apart and do not count toward the verdict.
- JSON Web Tokens are decoded in the page so you can see the issuer, subject and expiry. An expired token drops to low.
- The redacted copy swaps each secret for a label like
[REDACTED:stripe-live-secret]and leaves the rest intact.
What it detects
Secret scanner FAQ
Does the secret scanner send my text anywhere?
No. Matching, masking and redaction run in JavaScript already on the page. The scanner never calls a provider to test whether a key works, because that would send the key off your device.
I found a live key in a git commit. Is deleting the commit enough?
No. Rotate the key first. Anything pushed is in forks, clones, CI caches and mirrors, and bots scan public pushes within minutes. Revoke or rotate at the provider, check its logs for use since the push, then clean the history if you still want to.
Why is a match marked as a likely placeholder?
The value contains words such as EXAMPLE, xxxx, changeme or your_key, repeats one character, or has too little randomness to be a generated key. AWS's documented example key AKIAIOSFODNN7EXAMPLE is one. Placeholders are listed but do not count toward the verdict.
What does the redacted copy do?
It replaces every finding with a label such as [REDACTED:aws-access-key] and keeps the rest of the text, so you can paste a log or config into a ticket, chat or AI assistant without the secrets.
Can the scanner miss secrets?
Yes. Keys with no fixed prefix, such as a Cloudflare API token or a random password, are only caught when they sit next to a name like token, secret or password and look random. Seed phrases and secrets split across lines are out of scope.
Patterns follow each provider's published key format as of October 2026. Sample keys on this page are fake.