Scan text or code for accidentally exposed secrets like API keys, tokens, passwords, and private keys using pattern matching.
Paste code, config files, or logs into this tool and it scans the text for strings that match the known formats of real-world credentials: AWS access key IDs, GitHub and Slack tokens, Stripe keys, PEM private-key blocks, and similar. Matching is by shape, not meaning: a string is flagged because it looks like a credential, with the matched value and its location reported so you can act on it. The thing most people get wrong: a clean scan does not mean the text is safe. Formats the scanner has no pattern for pass through silently, and nothing here checks whether a flagged key is real, live, or already revoked.
A concrete input and expected output from the current implementation.
Input
GITHUB_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyz
Expected output
GitHub Personal Access Token (classic) detected at line 1 - matched value: ghp_1234567890abcdefghijklmnopqrstuvwxyz
The classic GitHub personal access token format is the prefix ghp_ followed by exactly 36 alphanumeric characters. The value after the equals sign is 40 characters long - the 4-character prefix plus a 36-character suffix - so the GitHub pattern matches it. The scanner reports the match on format alone; it does not check the token against GitHub.
The scan runs a library of regular expressions over the pasted text as plain text - comments, string literals, and prose are all treated alike. Each pattern encodes one credential format: a known prefix (such as ghp_ or AKIA), a fixed length, a character set, or a structural marker like a PEM header line. Every hit is reported with the matched value and where it appears in the document.
Matching is format-only. The same pattern fires for a live token, a revoked one, and a format-valid sample copied from vendor documentation - the scanner cannot tell which you have. Coverage is also bounded: credentials from new or niche services, or secrets in custom formats, are invisible unless a pattern exists for them. Treat results as leads to check, not verdicts.
No. The scan runs entirely in the browser and nothing you paste is uploaded or stored. The honest caveat: if the text contains a secret that is still valid, the exposure already happened wherever that text previously left your machine; scanning it locally only tells you what is in it.
Not necessarily. The match means the text contains a string shaped like that credential type; it could be a live key, a revoked one, a placeholder, or a documented sample. Treat every match as potentially live, rotate the credential at the provider, and remove the string from the text and anywhere it was pasted.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.