Secret Leak Scanner — Find API Keys in Code & Diffs
Paste code or a git diff and detect leaked credentials — AWS keys, GitHub and Slack tokens, private key blocks, hardcoded API keys and JWTs. Matched values are masked, never displayed.
Last reviewed 2026-10-19. Rates change — verify against the official sources linked below before relying on these figures.
What this is based on
- Detects six high-confidence patterns: AWS access keys, GitHub tokens, Slack tokens, PEM private-key blocks, generic 'key = value' secrets, and JWTs.
- If the input looks like a unified diff, only added (+) lines are scanned — matching the behavior of pre-commit scanners.
- Matches are fingerprinted (first 4 chars + length), never shown in full.
- Everything runs locally in your browser — pasted content is never uploaded, logged or stored.
A match means rotate, not just delete
If the scanner flags something that was ever committed, pushed, pasted in a ticket or logged — it's compromised regardless of whether anyone downloaded it. Deleting the line does nothing; the value lives in git history, CI logs and search indexes forever.
The only remediation is revocation: rotate the key at the provider, then clean history as a secondary step. For full-history scanning across every commit and branch, the CLI version and the full agent skill cover much deeper patterns.
Where leaks actually happen
Not in .env files (everyone knows those) — but in test fixtures, example configs, debug logging, error messages that echo request headers, and 'temporary' debugging commits that land in main. Scanning diffs before merge catches exactly these.
Frequently asked questions
- Does this upload my code?
- No — pattern matching runs entirely in your browser. Nothing is sent anywhere; scan production code safely.
- Why are matched values masked?
- So the tool itself can't leak your secret into screenshots, shared windows or logs. You get the first 4 characters and the length — enough to identify and rotate it.
- What about secrets this doesn't catch?
- High-entropy strings without recognizable prefixes (random passwords, some provider keys) need entropy-based scanning — that's what the full agent skill adds, along with git-history traversal.
Related calculators
Paste a Dockerfile and get an instant security review: baked secrets, unpinned base images, root containers, curl-pipe-to-shell and remote ADD — all checked locally.
Paste a GitHub Actions workflow YAML and catch the top-5 CI/CD risks: unpinned actions, script injection, pull_request_target abuse, secrets in run steps and write-all permissions.
Paste a JWT and instantly see its header, claims and expiry — decoded entirely in your browser. No upload, no sign-up, nothing leaves your device.