Web Security

Secret and Credential Leak Scanner

Scans pasted code, config or logs for committed secrets and shows any matches truncated. Heuristic, runs locally.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the code, config or log you want to check.
  2. Select Scan for secrets.
  3. Review each match by line number - matches are shown truncated so the result is safe to share.
  4. For any real secret, rotate it. Removing the line is not enough once it has been committed.

What secret leak scanner does

Secrets leak into code the same way every time: a key pasted in to get something working and then committed. Once it is in the history it is effectively public, and the fix is to rotate the key, not to delete the line. Catching it before the commit - or auditing a file you are about to share - is far cheaper than the alternative.

Paste code, configuration or a log and this scans for the shapes that give secrets away: cloud access keys, provider tokens, private-key blocks and the generic password-equals assignment. Matches are shown truncated so the result is safe to screenshot. It is a heuristic - it produces false positives and can miss an unusual secret - and it runs entirely on this page: the text is never uploaded. Verify a match before acting, and rotate anything real.

Frequently asked questions

No. The scan runs entirely in your browser against the text you paste. Nothing is sent to a server, which is what makes it safe to paste a file you are worried already contains a secret.

No - it is a heuristic. It matches the shapes of common keys and tokens and the generic password-equals assignment, so it produces false positives and can miss a secret that does not fit a known pattern. Treat a clean result as encouraging, not as proof.

No. Once a secret is in the history it should be treated as public. Rotate the key or token so the exposed value stops working, then remove it from the code. Rewriting history helps but does not undo the exposure.