Paste git diffs and detect leaked credentials, tokens, and secrets using pattern-matching rules.
Git Diff Secret Finder screens pasted patch text for strings that resemble exposed credentials, access tokens, and other secrets. It applies pattern-matching rules to the exact diff you provide and returns candidates for human review before a patch is committed, posted, or attached to an issue. The important surprise is that a match is an alert, not proof that the value is genuine, active, or sensitive. Conversely, a scan with no findings is not proof that the patch is safe: unfamiliar formats, transformed values, and secrets outside the pasted diff can remain undetected. Read findings in the context of Git's added, removed, and unchanged lines.
Paste a textual Git diff, including its file headers, hunk markers, and changed lines. The finder treats that supplied patch as its search scope and compares its text with rules for secret-like formats. It does not infer missing content from a repository name or inspect files that were not pasted. Use the surrounding hunk and each line's prefix when deciding whether a candidate represents an addition, deletion, or context.
Processing occurs entirely in the browser, so this tool does not upload the pasted diff. That is especially relevant because the material being checked may already contain a live credential. Pattern matching measures textual resemblance only; the finder does not authenticate against an issuing service, test permissions, establish ownership, determine exposure, or decide whether a token has expired. Verification, rotation, and revocation must be handled outside the finder.
No. A finding means only that the text matched a rule for a secret-like form. The finder does not contact an issuer, test authentication, or establish who owns the value. Treat an unexpected candidate as potentially exposed until it is identified. If it could be real, rotate or revoke it through the relevant provider and review every place the diff was shared.
No. Deleting the value removes it from the newest file version, but an earlier commit may remain in repository history, forks, caches, review systems, clones, or copied patches. If exposure is possible, rotate the credential rather than relying on deletion. History rewriting can reduce later access to the old commit, but it cannot make an already disclosed credential safe to keep using.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.