Secret & API Key Scanner

Paste logs, config files, or env dumps and detect leaked credentials — AWS keys, GitHub/GitLab PATs, Stripe, Slack, OpenAI, Google, JWTs, and private keys. All scanning runs locally in your browser.

Scan text

Mask matches (show only first 4 + last 4 chars)

Flag generic high-entropy strings (32+ chars)

Findings

Redacted output

—

Error

How it works

Every line is scanned against a library of known credential patterns: AKIA… for AWS access keys, ghp_… / github_pat_… for GitHub, glpat-… for GitLab, sk_live_… / sk_test_… for Stripe, sk-… for OpenAI, AIza… for Google, xox* for Slack, PEM private-key blocks, and eyJ… JWTs.
Secrets without a fixed prefix — like AWS secret access keys — are caught with a context heuristic: a long base64 token near the words aws or secret.
Optionally, generic high-entropy tokens are flagged with Shannon entropy: random-looking strings score high, while words and sentences score low and are ignored.
Everything runs in your browser as a plain regex scan. Nothing is uploaded, logged, or stored.

About Secret & API Key Scanner

Leaked credentials are one of the most common ways accounts get compromised: a developer pastes a config file into a chat, a build log prints an environment variable, or a support ticket includes an API key. This scanner helps you find those patterns before you share them — the redact feature rewrites every detected secret as [REDACTED:Label] so you can share sanitized logs safely.

Pattern matching is a strong first pass but not proof: a 40-character base64 string near the word aws is usually a secret access key but can be a false positive, and a real credential with an unknown format will not be flagged at all. Treat every finding as a potential leak, rotate any key you are not 100% sure about, and scan your repositories and chat history with a dedicated tool as part of your incident-response workflow.