Secret Scanner
Scans pasted code, logs or a config dump for API keys, tokens and private keys, with entropy heuristics.
Keys get committed, pasted into issues and printed into logs, and the moment that happens they are public whether or not anyone noticed. This reads pasted code, a log dump or a config file and points at the strings that look like credentials — by known provider formats first, then by entropy for the ones with no format at all.
Scanned as you type, in a worker, in this tab.
Nothing leaves this tab. In particular, no key found here is sent to its provider to check whether it is live — that would take every credential in your source and hand it to a third party from your own machine, which is the exact harm a secret scanner exists to prevent. The offline checks are arithmetic done here: the format the provider publishes, and, for a GitHub token, the checksum GitHub builds into it. Findings show a masked preview only, so the report is safe to paste into a ticket.
How to use it
Paste the text or drop the file
Anything textual works — source, `.env`, a CI log, a config dump. It runs in a worker, so a large paste does not freeze the page.
Read the format matches first
A hit on a known prefix — `AKIA…`, `ghp_…`, `sk-…`, a PEM block header — is close to certain. Those are the ones to deal with before anything else.
Treat entropy hits as candidates
A high-entropy string with no recognised shape may be a key, a hash, a UUID, a minified asset or a base64 image. The tool says which rule fired so you can judge.
Rotate, then clean up
A leaked key is leaked. Deleting the commit or editing the log does not un-publish it, so revoke and reissue first and tidy the history second.
Common questions
Does a clean result mean there are no secrets?
No, and this is the limit worth understanding. It finds patterns it knows and strings that look random. An internal key format with low entropy, a password that reads like a word, or a credential split across two variables all pass straight through.
Does it check whether the key still works?
It cannot, and would not. Verifying a key means using it against the provider, which sends your credential to a third party — the opposite of what this page is for. Whether a key is live is something only its issuer can tell you.
Is my code uploaded?
No. Scanning happens in a worker in your browser. A tool that asks for the file most likely to contain your secrets should not also be sending it somewhere.
Everything in my minified bundle is flagged.
Minified output is dense and looks random by construction, which is exactly what the entropy rule keys on. Scan sources rather than build artefacts, or narrow to the format-based rules.
Feed it from
Redaction Verifier
Checks a supposedly redacted PDF for text, images or metadata still hiding under the black boxes.
Invisible Character Remover
Finds and strips zero-width spaces, BOMs, soft hyphens and bidi controls hidden in pasted text.
Text Anonymiser
Finds emails, phone numbers, card numbers and IDs in free text and masks or pseudonymises them.
Kubernetes Secret Decoder
Decodes every Base64 value in a Secret manifest, and re-encodes an edited one ready to apply.
Next
These accept what this tool produces, so the result can go straight in.
.env Parser & Converter
Parses a .env file and converts it to JSON, YAML, shell exports, Docker or Kubernetes formats.
Entropy Meter
Measures the Shannon entropy of a string or file and shows a byte histogram — useful for spotting keys.
HAR Viewer & Sanitiser
Opens a HAR capture as a waterfall and strips cookies, auth headers and tokens before you share it.
Text Anonymiser
Finds emails, phone numbers, card numbers and IDs in free text and masks or pseudonymises them.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
CSV Cleaner
Trims cells, normalises headers, fixes number and date formats and reports rows with the wrong column count.