Secret & API Key Scanner
Find leaked API keys, tokens and passwords in code, config, logs and diffs, then redact them
Input
Any text file up to 2 MB. Imported files are read as plain text and never run.
Advanced
Categories
Findings
Redacted output
Every finding is replaced, including secrets on diff lines that are not listed. Hidden false positives stay as they are.
Pattern matching can miss secrets and can flag safe values. Review the redacted copy and rotate any credential that was exposed.
What is the Secret & API Key Scanner?
The Secret & API Key Scanner checks code, configuration, logs, environment files and git diffs for credentials before you commit, paste or share them. It recognizes provider keys and tokens (AWS, GitHub, GitLab, Stripe, OpenAI, Slack, Google and many more), private key blocks, database and broker URLs with passwords, authorization headers, JWTs, webhook secrets and passwords assigned to sensitive key names. Results show the line and column, the provider, a confidence level and a masked preview, and a redacted copy is ready to copy or download.
How to use
- 1.Paste text, import a text file up to 2 MB, or load an example.
- 2.Keep Input type on Auto-detect or pick the format. For a git diff, Only added lines lists findings from added lines only; the redacted copy still covers every line.
- 3.Choose Scan. Findings are sorted by severity; select a line to jump to it in the input.
- 4.Reveal a value only when you need to check it, and hide false positives so they stay unredacted.
- 5.Pick a redaction style, then copy the redacted text or download a safe copy.
How detection works
Detection combines a known provider prefix, the key or header name around the value, the expected length and character set, and randomness (entropy). Random-looking values alone are only reported at Low confidence, because hashes, UUIDs and build IDs look random too. Placeholders such as changeme, your-key or environment references like process.env.API_KEY are ignored. In source code, values that are variables or type names instead of quoted literals are skipped. Personal, financial and address data are off by default and can be turned on under Advanced.
Privacy and limitations
Scanning and redaction run in your browser: the text is not uploaded, stored, logged or added to the page address, and raw values are only shown when you choose Reveal. The scanner cannot prove that no secrets remain: organization-specific formats, split or encoded values and secrets in binary files can be missed. It does not check whether a credential is still valid. Treat every exposed credential as compromised and rotate it.
