Secret Scanner
Find leaked API keys, tokens, private keys and passwords in text or files, in your browser.
Runs in your browser Your input never leaves your device.
Drop text files here, , or paste text below. Files are read in your browser and never uploaded.
Nothing leaves your browser. The scan uses about 40 rules for documented token formats plus a few generic patterns with an entropy check, so it finds common leaks but is not exhaustive: it cannot know a custom secret. If a real secret is found, revoke it first; removing it from the code does not undo the leak, especially once it was committed or shared.
Report a problem with this tool
About this tool
A secret that ends up in code, a config file, a log or a chat message can be found and abused within minutes. This scanner checks text for the formats of common credentials: AWS access keys, GitHub, GitLab, npm and PyPI tokens, Stripe live keys, Slack tokens and webhooks, Google API keys and OAuth secrets, OpenAI and Anthropic keys, SendGrid, Mailgun, Twilio, Shopify, Telegram and Discord tokens, PEM private keys, JSON Web Tokens, passwords inside URLs, and generic password or secret assignments that pass an entropy check so that placeholders such as changeme are ignored. Paste text or drop one or more files; they are read in your browser and never uploaded, which is the point: you can check a file before you share or commit it without handing the secret to yet another service. Each finding shows the rule, the line and column, a masked value (use the checkbox to see it in full) and what to do about it. Likely placeholders and documentation examples are hidden by default. On generated tokens of the formats both tools cover, everything gitleaks flags is also found here, and every pattern is limited so that hostile or huge input cannot freeze the page: very long lines (such as minified bundles) are skipped and the whole scan stops after six seconds. No scanner is complete, and a clean result does not prove a file is free of secrets. If you find a real one, revoke or rotate it immediately: deleting it from the file does not undo the exposure.
How to use it
- Paste the text, or drop the files you want to check.
- Read the findings, highest severity first.
- Revoke or rotate every real secret at its provider first, then remove it from the code and load it from the environment or a secrets manager.
- If the secret was ever committed, treat it as public even after you delete it, because it stays in the history.
Common problems
- It flags something that is not a secret
- Test keys, example values and tokens in documentation can look real. Check the line and the provider. Likely placeholders are hidden by default.
- I know there is a secret but it is not found
- Only known formats and assignments with a name like password or secret are detected. A random string without a recognisable prefix or label cannot be told apart from other data.
- It says some long lines were skipped
- Lines over 10,000 characters, usually minified or bundled code, are skipped to keep the page fast. Scan the original source instead.