🔍 Security Tool

Secret Scanner

Paste code, config files, or logs to scan for leaked API keys, tokens, private keys, and hardcoded secrets. 100% local regex matching — nothing leaves your browser.

🔒 All scanning runs locally in your browser. Zero network requests. Open DevTools → Network to verify.

Want to scan your entire repository automatically?

This tool checks what you paste. The Repo Security Scanner walks your full GitHub file tree, checks .gitignore coverage, scans source files, and verifies Supabase RLS policies — free for public repos.

Scan Full Repo →
Does this tool upload my code?
No. All scanning happens in your browser using JavaScript regex matching. Your code, config files, and secrets never leave your machine. Open your Network tab to verify zero outbound requests.
What secret patterns does this detect?
Stripe API keys, GitHub personal access tokens, AWS access keys, Slack tokens, Google API keys, JWT tokens, private key blocks, hardcoded password assignments, generic API key patterns, and connection strings.
How is this different from the Repo Scanner?
This tool scans text you paste directly — ideal for quick checks on config snippets, log output, or code fragments. The Repo Scanner analyzes an entire GitHub repository automatically, checking file trees, gitignore coverage, CI configs, and Supabase RLS policies.
What should I do if secrets are found?
Rotate every exposed credential immediately. Remove the secret from code and move it to environment variables or a secrets manager. If committed to git, assume it's compromised even after deletion — git history retains old versions indefinitely.