Secret Scanner
Paste text; find keys from 40 providers, how to revoke them, and a redacted copy.
Your text never leaves this tab. Keys are never tested against providers.
How it works, coverage and FAQBackground readingLeaked API keysCloud key management
How the scanner works
Each line is matched against 40 provider key formats (such as ghp_, sk_live_, AKIA), private keys, JWTs, database URLs and random values named token, secret or password.
Placeholders are listed apart and do not count. JWTs are decoded; an expired one drops to low.
What it detects
Secret scanner FAQ
Does the secret scanner send my text anywhere?
No. Matching and redaction run in the page, and no key is tested against its provider.
I found a live key in a git commit. Is deleting the commit enough?
No. Rotate the key first, since pushes are copied and scanned within minutes. Then check the provider's logs and clean the history if you want.
Why is a match marked as a likely placeholder?
It contains words such as EXAMPLE, xxxx or changeme, repeats one character, or is too low in randomness. Placeholders do not count toward the verdict.
What does the redacted copy do?
It swaps each secret for a label such as [REDACTED:aws-access-key] so you can share the rest safely.
Can the scanner miss secrets?
Yes. Keys with no fixed prefix are caught only next to a name like token or password. Seed phrases and secrets split across lines are out of scope.
Patterns follow each provider's published key format as of October 2026. Sample keys on this page are fake.