Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords. Everything runs locally in your browser — nothing is uploaded.
Full-featured API client that runs in your browser — make HTTP requests, edit headers/body/params, save collections, generate code snippets (cURL/Fetch/Axios). Your API keys never touch a server — everything runs locally.
Hash API keys using SHA-256 for secure storage. Never store raw API keys — hash them before persisting to your database.
Generate cryptographically secure random tokens in hex, base64, or alphanumeric format. Perfect for API keys, session tokens, and secrets. Everything runs locally in your browser — nothing is uploaded.
Converts alphanumeric text into International Morse code with audible beeps played through the Web Audio API, and decodes incoming Morse signals. Everything runs locally in your browser — nothing is uploaded.
Convert Markdown formatting to Slack mrkdwn syntax — bold, italic, links, code blocks, and lists translated automatically.
Stripe API keys, GitHub/GitLab tokens, Slack tokens, AWS access keys, Google API keys, OpenAI keys, JWT tokens, private keys (PEM), database connection strings, and hardcoded passwords in config files.
Review each flagged item. If it's a real credential, rotate it immediately in the respective service's dashboard. Remove the secret from code and use environment variables or a secrets manager instead.
Yes. Paste the contents of any file — .env, docker-compose.yml, kubernetes manifests, config files, or source code. The scanner checks for patterns matching known secret formats.
The scanner uses regex patterns that may flag placeholder values (e.g., 'YOUR_API_KEY_HERE'). Always verify flagged items manually before rotating credentials.
No. All scanning happens locally in your browser. No code or detected secrets are sent to any server.