Skip to content
>_ITDITDWeb Security Platform

Secret Leak Scanner

Just before you commit, publish, or share, paste code or config to find hardcoded API keys, tokens and private keys — so you catch them before they leak. Everything runs in your browser; your input is never sent.

Everything runs in your browser. Your input is never sent to a server.

Paste code or config to see results here. New here? Hit “Try an example” above to see how it works.

How to use

  1. 1

    Paste right before exposure: before using AI-written code, before pushing to GitHub, before sharing a snippet.

  2. 2

    Known key formats (AWS / OpenAI / GitHub / Stripe …) and secret-looking assignments are detected.

  3. 3

    If found, revoke + rotate the key. For ongoing protection, automate (see below).

Why it matters

This tool is for the few-seconds check *before* a secret leaks: before using AI-generated code, before pushing to GitHub, before pasting a snippet into a gist, forum, blog, or to another person or AI. A key that's already in production is already leaked — for that, rotation is the answer, not this tool. And honestly, pasting by hand every time doesn't scale. The durable defense is automation: a pre-commit hook or CI secret scanner (gitleaks / trufflehog) and GitHub push protection. This manual check is the entry point — for a quick one-off scan, a last look before publishing, or learning.

FAQ

QIsn't it too late once it's in production?
A

Right — a published key is already leaked, which is exactly why you use this before it ships. This tool is for the moment just before you commit, publish, or share. If a key already leaked, rotation (replace everything) is the answer. For ongoing protection, automate with a pre-commit hook or CI secret scanner.

QPasting by hand every time won't scale, will it?
A

Correct. So this tool is for a quick one-off check, a last look before publishing, or learning. Your day-to-day defense should be automated — add gitleaks / trufflehog to pre-commit or CI, and enable GitHub push protection.

QIs my pasted code sent anywhere?
A

No. Detection runs entirely in your browser (JavaScript regex); your input is never sent to a server.

QIf nothing is found, am I safe?
A

No. This is lightweight known-pattern detection, not exhaustive. Even with zero findings, the design rule is to never hardcode keys or ship them in public artifacts.

Related