Secret scanner that never leaves your browser
Paste logs, an env file or a git diff. Secret Scan Lite finds API keys, tokens, private keys and passwords, masks them, tells you how serious each one is and what to rotate, and gives you a clean copy that is safe to share.
A free pattern scanner for pasted text. It knows the shapes of keys from AWS, GitHub, GitLab, OpenAI, Anthropic, Stripe, Slack, Google, SendGrid, npm, PyPI, Twilio, Discord and Telegram, plus private keys, database URLs, JWTs and password assignments.
Developers before a pull request, support teams who receive log dumps, founders about to paste an error into a group chat, and reviewers checking a diff.
Secrets slip into logs, screenshots and commits all the time. Once shared, they are copied everywhere. A quick local check catches the obvious ones while you can still just delete the message.
The scan runs in this tab. Nothing is uploaded, logged or stored.
Paste something, or load one of the demo files to see a full report.
Even a masked report reveals which services you use. Share it only with people who need it.
Twenty four kinds of secrets, ranked by what an attacker could do with them.
Direct access to money, infrastructure or data.
Can post, send or read as you.
Sensitive and often reusable.
Placeholders and examples. Worth a look, rarely a leak.
Logs, env files, stack traces or a diff. Use the demo files to see every kind of finding first.
Critical and high findings mean do not share. Placeholders are listed separately so they do not drown out real problems.
Each finding says where to revoke it. Removed lines in a diff still live in git history, so rotate those too.
Copy the masked text into the ticket or chat, and keep the report with fingerprints for the security thread.
No. The scan is plain code running in this page. You can load it, go offline and it still works.
Stripe test keys cannot move money, so they are ranked lower. They still deserve a rotate if they were public.
It estimates how random a value is. Real keys usually score above 4, words and placeholders score lower.
This tool is built for pastes. For full history scans use a dedicated scanner in your CI pipeline.