// TOOLS

Security Tools

🔑 Secret Scanner

Paste code, a .env or a log and spot leaked credentials: AWS keys, GitHub/Slack/Stripe tokens, private keys, JWTs, assignments like password="…" and high-entropy strings. It runs in your browser: the text is never uploaded, and findings are shown masked.

Frequently asked questions

Is the code I paste uploaded anywhere?

No. The analysis runs entirely in your browser with JavaScript; the text never leaves your machine or gets sent to any server. You can verify it in the browser's network tab.

What kinds of secrets does it detect?

AWS keys, GitHub tokens (classic and fine-grained), Slack and Stripe tokens, Google API keys, private keys in PEM format, JSON Web Tokens (JWT), assignments like password="…" or api_key="…", and high-entropy strings that look random (possible keys with no known format).

Does it show the full secrets?

No. Each finding is shown masked (only the start and end), so the full secret is not exposed on screen again. Even so, any secret that appears here should be considered compromised and rotated.

If it finds nothing, am I safe?

Not entirely. It is a pattern- and entropy-based check: it covers the most common cases, but no scanner catches everything (secrets with unusual formats, obfuscated or split across lines can slip through). Use it as a first pass, not a guarantee.