Secret Scanner
Paste text and see the API keys, tokens and personal data hiding in it.
The scan runs in your browser, so nothing you paste leaves this page.
✓ Runs in your browser ✓ Nothing is uploaded ✓ No account, no cap
Paste, scan, redact.
The engine behind this page is the same detection engine that ships in the API Key Leak Intercept extension. It reads the text where it already sits, matches the formats that matter, and hands you a version of the text you can share. No processing step runs anywhere else.
1. Paste
Drop in whatever text you have. The scan runs the same on log excerpts, config files and chat messages.
2. Scan
Known key formats for 40+ providers come first, then JWTs, bearer tokens, private keys, database URLs and password assignments. An entropy pass catches the tokens nobody has named yet.
3. Redact
Every secret becomes a typed placeholder like [API_KEY_1] in the redacted copy, so the document keeps its shape while the values stay behind.
Does the secret scanner send my text anywhere?
No. The whole scan runs in your browser on this page. Nothing you paste is uploaded, stored or logged. Once the page has loaded you can go offline and the scanner keeps working.
What can the secret scanner find?
It matches known API key formats for 40+ providers including OpenAI, Anthropic, AWS, Stripe, GitHub, Slack and Google, along with JWTs, bearer tokens, PEM private keys, database connection strings, .env blocks and password assignments. A high entropy pass catches token formats nobody has named yet. It also flags personal data like email addresses, credit cards, US social security numbers and national IDs for 30 countries.
What are the [API_KEY_1] placeholders in the redacted copy?
That is the redacted output. Each secret is replaced with a typed placeholder that keeps the shape of the document while the value stays behind. [AWS_KEY_1] tells a reader an AWS key was there. Two occurrences of the same secret get the same placeholder, so a thread through a log is still readable.
How is this different from the API Key Leak Intercept Chrome extension?
The scanner checks text you already have in front of you. The extension checks text at the moment you paste it into ChatGPT, Claude or any AI chat, and stops the send before the key leaves the browser. Both run the same open source detection engine.
Catch the next one at the paste box
This scanner shows you what a given block of text already carries. The Chrome extension stands between your clipboard and every AI chat and stops the send before a key leaves the browser. Free, open source, same engine as this page.
Next step
Send the thing that needs fixing
Paste the broken workflow or the messy handoff, get the failure point and a fix path in writing. Free, no call, reply within 24 hours.
Run the free diagnostic →Stay in the loop.
Technical breakdowns, new system builds, and lessons from deploying autonomous AI. One email a week, direct to your inbox.
One email a week. Leave with one click.