Secrets & Config
Scan pasted code or config for API keys, tokens, and private keys.
Runs entirely in your browser
Nothing you paste is uploaded. Monaco and Prettier load on demand from this origin.
Paste code or config
Scanned locally — nothing is transmitted
| Line | Type | Match (redacted) |
|---|---|---|
| 1 | AWS access key | AKIAIO…MPLE |
| 2 | GitHub token | ghp_12…wxyz |
| 2 | Generic secret assignment | token …xyz" |
| 3 | Generic secret assignment | api_ke…123" |
There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to secret scanner
- Paste text. Paste the code, config, or log to scan.
- Scan. Known secret patterns are flagged with their type.
- Remediate. Rotate and remove any exposed credentials found.
Leaked credentials are among the most common and damaging mistakes — a key in a commit, a token in a log. Scanning text before you share or commit it catches those exposures while the secret is still in your hands.
Crucially, the scan is local, so you're not transmitting the very secrets you're worried about. Diff env files with the .env manager and scrub HAR captures with the HAR viewer.
Frequently asked questions
What kinds of secrets can it find?
Common patterns like cloud API keys, tokens, private keys, and connection strings — the credentials that most often get committed or logged by accident.
If it's clean, am I safe?
It catches known patterns, so a clean result is reassuring but not a guarantee. Still, it's a fast pre-commit or pre-share check.
Is my text uploaded to scan it?
No. Scanning runs in the browser, which is essential — sending suspected secrets to a server would defeat the purpose.