← All Tools

Bucket Exposure Checker

Public bucket, public shame. A passive, credential-free look at whether an S3, Cloud Storage or Azure Blob name exists, can be listed, can be read — and what its error codes give away.

⚠ Authorized use only. Only check storage you own or are engaged to assess. Probing other people’s buckets can breach the provider’s terms and, in many jurisdictions, computer-misuse law. Checks are limited to 10 per minute, one name at a time, and nothing you enter is stored.

The requests to the storage endpoints are made from this server (your IP is never forwarded, redirects are not followed, responses are capped at 64 KB). The name you enter is used for the check and the rate limit only — it is not logged.

How to read it. Not Found: no bucket with that name (on the providers tried). Exists — Private: it is there, anonymous listing is denied. Publicly Listable: anyone can enumerate the object names — including when a probe returns NoSuchKey rather than AccessDenied, which means anonymous ListBucket is allowed. Publicly Readable: a common object (index.html, robots.txt) was served without credentials. Possible Takeover Target: you pasted a URL or hostname that points at a name nobody owns. Results are heuristic — a bucket with no index.html can still be public for other keys.