← All Tools

Secrets & Credential Leak Scanner

Found your API key sitting in the broth. That's not seasoning. Paste code, a config or .env file, a pipeline definition, logs or a chat export — get every secret-looking value with a confidence tier, a rotation note, and a redacted copy you can actually share.

🔒 Nothing you paste here leaves this page. Verifiably. The scan runs in your browser with a static rule set; this page has no server endpoint, stores nothing (no draft, no history, no localStorage), and hands nothing to other tools. Open your browser's developer tools on the Network tab, paste a real key, press Scan: you will see no request. Findings are masked on screen by default — reveal them one at a time only when you need to.

How it decides. High confidence = a provider-specific format (an AKIA… access key ID, a ghp_ token, a PEM header) that is almost never anything else. Medium = a specific-but-generic shape (credentials inside a URL, an Authorization header, an entropy check on a value assigned to a secret-ish name). Low = a password = … style heuristic — read it before you act on it. Values that look like documentation examples (AKIAIOSFODNN7EXAMPLE, your-api-key-here, ${VAR}, xxxxxxxx) are listed separately so a tutorial snippet does not cry wolf. Severity is the blast radius if the value is real: a Stripe live key is critical, a test key is low. Whatever the tier: a secret that was ever pushed to a shared or public repository is compromised, even if you removed it a minute later — rotate it. Looking for PII (IPs, e-mails, session IDs) rather than secrets? That is the Log Snippet Anonymizer; checking a prompt before it goes to an LLM is the LLM Pre-flight Redactor (same rule set for secrets); checking your dependencies rather than your code is the Dependency Vulnerability Scanner. A JWT found here can be inspected in the JWT Decoder. Rule set . Informational only — not a guarantee that nothing is left.