Secret Scanner

Scan pasted text for accidentally-committed secrets — AWS keys, GitHub/Slack/Stripe/Google tokens, JWTs, and PEM private keys — entirely client-side. Nothing is sent anywhere.

13px
13px

Entropy Detection

Additional pass (same technique as gitleaks/trufflehog): scans base64/hex-like runs for Shannon entropy and flags high-randomness tokens as a possible unknown-format secret, even if they don't match any named pattern above.

Custom Rules

Add org-specific patterns (internal token formats, ticket IDs treated as sensitive, etc.) to scan for alongside the built-in rules.

No input yet

Paste some text or load the example above to scan for secrets.

Heuristic, client-side pattern matching only — it complements but does not replace dedicated scanners like gitleaks or trufflehog in CI. Nothing you paste here is transmitted over the network.

Secret Scanner

Scan pasted text for accidentally-committed secrets — AWS keys, GitHub/Slack/Stripe/Google tokens, JWTs, and PEM private keys — entirely client-side. Nothing is sent anywhere.

Common uses

  • Scan a log file for leaked API keys
  • Check a config file for hardcoded secrets before committing
  • Redact all secrets found in pasted text

Also searched as

  • scan text for leaked api keys
  • detect aws access key in text
  • github token detector online
  • find hardcoded credentials
  • pem private key detector
  • gitleaks alternative online
  • trufflehog alternative online
  • redact secrets from log
  • check config for secrets before commit
  • stripe key detector
  • slack token scanner

Frequently asked questions

How do I check a file for accidentally committed secrets?

Paste the text into the Secret Scanner. It flags AWS keys, GitHub, Slack, Stripe and Google tokens, JWTs and PEM private keys.

Can it redact the secrets it finds?

Yes, it can redact secrets in the pasted text so you can share logs more safely.

Is this a replacement for gitleaks or trufflehog?

No. It's a quick paste-and-scan check, not a repository history scanner.

What should I do if I find a leaked key?

Revoke and rotate it at the provider right away, since removing it from the code doesn't invalidate it.

Is my data uploaded to a server?

No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.