What types of secrets can it detect?

The catalog covers AWS access and secret keys, Google Cloud API keys, service-account JSON and OAuth client secrets, Azure storage connection strings, GitHub personal access and OAuth tokens, GitLab tokens, Stripe live, test, and restricted keys, Slack tokens, Twilio SIDs and API keys, SendGrid, Mailgun, npm and PyPI tokens, OpenAI and Anthropic API keys, JWTs, PEM private-key blocks, PostgreSQL, MySQL and MongoDB connection URLs, and basic-auth URLs. Beyond those named rules, a high-entropy heuristic flags unknown strings that statistically resemble keys.

Is any of my code stored or uploaded?

No. This tool intentionally skips both URL syncing and local-storage persistence that other tools use, because the input may contain live secrets. Your code is held only in the page memory while you use it and is cleared when you reload or close the tab; nothing is sent to a server.

How does the high-entropy detector avoid false positives?

It only considers reasonably long alphanumeric tokens, then computes their Shannon entropy (bits per character) and keeps those above a threshold that random keys clear but English words and repeated characters do not. A guard also rejects pure numbers, short git hashes, and dotted or kebab-case identifiers, and the entropy pass never re-reports a value a named rule already matched. You can still get the occasional false positive — review entropy findings before acting on them.

Are the full secret values shown in the results?

By default every finding is masked, showing only the first and last four characters with the middle replaced by asterisks. You can click Reveal values to unmask them when you need to confirm a match, and toggle them back. The exported report, JSON, and baseline formats always use the masked form, so you can share results without re-exposing the raw secret.

What are the different export formats for?

The human report is a readable summary for a ticket or chat. JSON gives you machine-readable findings to pipe into other tooling. The detect-secrets baseline mirrors the format that tool uses, so you can seed an allowlist. The .gitignore output lists common secret-bearing files to exclude. The pre-commit hook provides a gitleaks configuration plus a dependency-free grep guard you can drop into your repo to block future leaks.

If something is flagged, what should I do?

Treat any real credential as compromised the moment it touched your working tree: rotate or revoke it immediately, move it to an environment variable or a secrets manager, and add the file to .gitignore. Each finding includes a provider-specific remediation note, and you should also scan your git history in case the secret was committed earlier.

Secret Scanner

Scan code, config, or .env contents for leaked credentials — AWS, GitHub, Stripe, Slack, OpenAI, Anthropic and Google keys, private keys, JWTs, database URLs and more — with a high-entropy heuristic for unknown secrets. Everything runs locally in your browser; nothing is uploaded, persisted, or put in the URL. Export a report, JSON, a detect-secrets baseline, a .gitignore, or a pre-commit hook.

About this ToolHow it works, benefits & use cases

Before you commit, paste your code, config, or .env contents here to catch credentials that should never reach a repository. The scanner matches against signatures for dozens of secret types across AWS, Google Cloud, Azure, GitHub, GitLab, Stripe, Slack, Twilio, SendGrid, Mailgun, npm, PyPI, OpenAI, Anthropic and more — access and secret keys, personal access and OAuth tokens, service-account JSON, connection strings, JWTs, and PEM private-key blocks — plus database URLs and basic-auth URLs that embed credentials. On top of the named rules, a Shannon-entropy heuristic flags unknown high-entropy strings that look like keys, with a false-positive guard that skips plain words, pure numbers, and short git hashes. Each finding shows its rule label, provider, severity, line and column, the matched value (which you can reveal or keep masked), and a concrete remediation note. Switch to Reference mode to browse the full provider catalog with safe, fake examples. Export your results as a human report, JSON, a detect-secrets-style baseline, a ready-made .gitignore, or a pre-commit hook. Crucially, the input is never uploaded, written to local storage, or placed in the URL — it stays in your browser memory only, so it is safe to scan files with real secrets.

How to Use

1In Scan mode, paste your source code, config file, or .env contents into the Code to scan panel.
2Or click Load example to scan a snippet seeded with realistic but fake secrets.
3Click Scan for Secrets to run the detection locally in your browser.
4Review the severity summary and each detected secret (label, provider, line and column, remediation).
5Toggle Reveal values to unmask a finding, then pick an export format (report, JSON, baseline, .gitignore, or pre-commit hook).
6Switch to Reference mode to browse the full catalog of provider patterns and their fake examples.

Key Benefits

Over 25 provider signatures: AWS, GCP, Azure, GitHub, GitLab, Stripe, Slack, OpenAI, Anthropic and more
Also catches private keys, JWTs, service-account JSON, DB connection strings and basic-auth URLs
Shannon-entropy heuristic for unknown secrets, with a guard against plain words and hashes
Pinpoints each finding by line and column with mask-by-default values and a remediation note
Five export formats: human report, JSON, detect-secrets baseline, .gitignore, and a pre-commit hook
Reference mode documents every rule with a safe, fake example
Runs entirely client-side and never persists input to local storage or the URL

Common Use Cases

A pre-commit gut-check on a file you are about to add to git
Reviewing a teammate diff or a paste for accidentally embedded credentials
Scanning a .env or config file before sharing it in a ticket
Generating a detect-secrets baseline or a pre-commit hook for your repo
Teaching developers what a leaked AWS key, GitHub token, or private key looks like

100% local scanning

Your input is scanned entirely in your browser. It is never uploaded to a server, written to local storage, or placed in the URL — so it is safe to paste files that contain real credentials.

Code to scan

Paste source code, a config file, or .env contents.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on

Secret Scanner

How to Use

Key Benefits

Common Use Cases

100% local scanning

Was this tool helpful?

Share Your Experience

Related tools

Frequently Asked Questions - Secret Scanner