Free Tool
Secret & Credential Scanner
Paste code, config files, or environment files to detect exposed secrets. Scans for AWS keys, GitHub tokens, Stripe keys, database connection strings, hardcoded passwords and more. Nothing leaves your browser.
🔒 100% client-side — nothing is sent to any server
Paste code and click Scan
Detects 19+ secret patterns including AWS keys, GitHub tokens, Stripe keys, database URLs, and hardcoded passwords.
What gets detected
AWS Access Key ID
Critical AKIA… pattern GitHub Tokens
Critical ghp_ / gho_ / github_pat_ Stripe Secret Key
Critical sk_live_ / sk_test_ PEM Private Key
Critical BEGIN PRIVATE KEY Database URLs
Critical postgres:// mongodb:// mysql:// Slack User Token
Critical xoxp- pattern Slack Bot/App Token
High xoxb- / xapp- pattern Google API Key
High AIza… pattern SendGrid API Key
High SG.… pattern Hardcoded Password
High password = "…" Hardcoded API Key
High api_key = "…" Hardcoded Secret
High secret = "…" NPM Auth Token
High _authToken = … GitHub Actions Token
High ghs_ pattern Stripe Publishable Key
Medium pk_live_ / pk_test_ JWT Token
Medium eyJ… format Common questions
No. All scanning runs entirely in your browser using JavaScript regex patterns. Nothing you paste is transmitted anywhere — not even anonymised analytics.
Pattern-based scanners produce false positives. Example values in documentation, test fixtures, or placeholder strings can match the patterns. Always verify each finding in context.
No. This tool covers 19+ high-confidence patterns — AWS, GitHub, Stripe, Google, Slack, SendGrid, database URLs, PEM keys, and hardcoded credentials. Entropy-based scanning (which finds random-looking strings without a known prefix) is not included.
Rotate it immediately — even if the commit was never pushed to a public repo. Treat it as compromised from the moment it was written. Then move it to environment variables or a secrets manager like Vault, AWS Secrets Manager, or Doppler.
This is a browser-based tool. For CI pipelines, look at truffleHog, gitleaks, or detect-secrets — they are purpose-built for automated scanning of git history and file trees.