Secret Scanner
Paste code, config or logs and find leaked secrets: AWS keys, GitHub and GitLab tokens, Stripe, Slack, Google, OpenAI and Anthropic keys, private keys, JWTs and passwords in URLs.
Free · No sign-up · Your inputs stay in your browser
Input
Scan text for leaked secrets
Output
6 possible secrets
| Line | Type | Match |
|---|---|---|
| 2 | Laravel APP_KEY | base••••••••••••••••2y4= |
| 3 | URL with credentials | post••••••••••••••••5432 |
| 4 | AWS access key id | AKIA••••••••••••MPLE |
| 5 | AWS secret key | aws_••••••••••••••••EKEY |
| 6 | Stripe secret key | sk_l••••••••••••••••le00 |
| 7 | Password assignment | toke••••••••••••••••yzAB |
Pattern matching on the formats providers publish for their keys, plus credentials in URLs and obvious assignments; references such as ${VAR} and env() are skipped. A secret that has been committed or pasted anywhere public is compromised: rotate it first, then remove it from history. gitleaks or trufflehog run the same kind of check on every commit.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Found one? Rotate it
A secret that reached a repository, a ticket or a log aggregator must be treated as compromised: revoke and replace it first, then clean up. Rewriting Git history does not help once the commit was pushed and cloned. GitHub's secret scanning and push protection catch many formats automatically for public repositories.
Prevent the next one
gitleaks and trufflehog run the same kind of pattern matching on every commit as a pre-commit hook or CI step. Keeping secrets in environment variables or a secrets manager, and .env files in .gitignore, removes most sources.