Skip to main content
Toolzum
Back to Developer

Secret Scanner

Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords. Code never leaves your device — formatting and validation run locally in your browser.

100% Local Browser Native

How to Use the Secret Scanner

1. Paste source for Secret Scanner

Paste source for Secret Scanner into the input area. Nothing runs until you trigger it.

2. Scan

Scan and read every finding.

3. Fix and rescan

Fix findings and re-scan.

Similar Tools You Might Need

See all

Bulk Regex Extractor & Replacer

Hunt IPs, API keys, emails, and URLs across thousands of logs or code files — extract matches or replace in place. SREs scrub 5,000 logs before sharing — local JS RegExp, 2 free batches a day.

Open Tool

JWT Debugger

Decode and inspect JWT tokens — view header, payload, expiration, issuer, subject, and other standard claims. Paste an HMAC secret to genuinely verify HS256/384/512 signatures — local inspection, free, no signup.

Open Tool

RSA Key Pair Generator

Generate RSA key pairs (2048/4096-bit) using the Web Crypto API. Export public and private keys as PEM strings. All client-side, no server uploads.

Open Tool

Font Generator

Preview your text in 6 Google fonts — Inter, Playfair Display, Fira Code, Pacifico, Outfit, and Montserrat — and copy the ready-to-use CSS import plus font-family rule. Free, local, no signup.

Open Tool

Secure Note Sharer

Share secrets securely via self-decrypting note links — AES ciphertext in the URL fragment, key in the link query. Send passwords without trusting inboxes — local crypto-js AES, free, no signup.

Open Tool

Frequently Asked Questions

What types of secrets does it detect?

Stripe API keys, GitHub/GitLab tokens, Slack tokens, AWS access keys, Google API keys, OpenAI keys, JWT tokens, private keys (PEM), database connection strings, and hardcoded passwords in config files.

How should I use the results?

Review each flagged item. If it's a real credential, rotate it immediately in the respective service's dashboard. Remove the secret from code and use environment variables or a secrets manager instead.

Can I scan .env files and config files?

Yes. Paste the contents of any file — .env, docker-compose.yml, kubernetes manifests, config files, or source code. The scanner checks for patterns matching known secret formats.

Does it detect false positives?

The scanner uses regex patterns that may flag placeholder values (e.g., 'YOUR_API_KEY_HERE'). Always verify flagged items manually before rotating credentials.

Is my code stored or transmitted?

No. All scanning happens locally in your browser. No code or detected secrets are sent to any server.

Related Developer Tools

SQL Injection Detector

Scan inputs and queries for SQL injection patterns — tautologies, unions, stacked queries. Catch ' OR '1'='1 before attackers do — local pattern matching, free, no signup.

API Key Hasher

Hash API keys using SHA-256 for secure storage. Never store raw API keys — hash them before persisting to your database.

Last updated October 2026