Secret scanner for code and config
Check code, .env files and logs for API keys, tokens and private keys with rules ported from gitleaks, before you paste them anywhere.
Input
Result
The result will appear here.The moment you paste a config file or a stack trace into a chat, an issue or a gist, any credential in it is out of your control. This tool scans pasted text with 50 detection rules ported from gitleaks (gitleaks/gitleaks, MIT) — the credentials most likely to turn up in code and configuration: OpenAI, Anthropic, AWS, GitHub, GitLab, Stripe, Slack, Google Cloud, Hugging Face, Alibaba Cloud, JWTs, private keys and generic key-like assignments. Each finding is shown with its line, column and rule, and only the first and last four characters of the secret.
How it works
- As in gitleaks, a rule runs only if one of its keywords appears in the text; the matched secret must then clear the rule's Shannon-entropy floor, which filters out placeholders like xxxxxxxx.
- gitleaks' global and per-rule allowlists apply, so AWS's documented example key, ${VARIABLE} references, {{ template }} placeholders and common stopwords are not reported.
- A line containing gitleaks:allow is skipped, and a generic finding that a specific rule already explains is dropped, so each key appears once.
- Scanning happens in your browser; the output never contains a full secret, and the site keeps no history of what you scan.
Where your data goes
Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.
This tool handles keys and credentials, so nothing about a run is saved, not even to your own history.
What it costs
This tool is free, with no sign-in and no points.
Common questions
- Why wasn't a password in my file flagged?
- Like gitleaks, the generic rule only matches values made of letters, digits and a few symbols such as . = -, assigned to a name that contains a word like key, secret, token or password. A value with # or ! in it, or a password that looks like an ordinary word, is not matched. Absence of findings is not proof the text is clean.
- How is this different from running gitleaks?
- It uses 50 of gitleaks' 222 default rules and its detection logic, but on one pasted snippet instead of a repository and its history. Rules that depend on file paths are dropped, since a snippet has none. For a repository, run gitleaks itself or enable GitHub's push protection.
- I found a live key. What now?
- Revoke or rotate it at the provider first — deleting it from the file is not enough once it has been shared or committed. Then check the provider's logs for use you do not recognise, and move the secret into an environment variable or a secret manager.
The open-source behind it
This tool is a self-contained implementation. gitleaks/gitleaks (MIT) does the same job as a library — if you need this behaviour inside your own program, start there rather than calling a web page.
gitleaks/gitleaksAlso known as
- secret scanner
- api key detector
- gitleaks online
- find leaked credentials
- detect secrets in code
- check env file for secrets