Paste code, a config file, logs or a support ticket before you share it. API keys, access tokens, private keys, connection strings and passwords are found and can be redacted in one click. The page cannot send anything over the network, so your text stays on this device. It is free.
How to scan for secrets, step by step
- Paste your text into the Text to scan box, or press Open a file.
- Watch the findings update as you type. They are counted as High, Medium and Low.
- Pick a line number to jump to the match. Matches are shown partly masked.
- Press Redact all to replace every finding, then Copy text.
What it looks for
Over 25 kinds of secrets with known formats, including AWS, GitHub, GitLab, Slack, Stripe, Google, Hugging Face, npm, PyPI, SendGrid, Twilio, Mailgun, Shopify and Telegram tokens, AI platform API keys, private key blocks, JSON Web Tokens and database URLs with passwords. It also flags values assigned to names like password, secret or api_key when they look random enough to be real. You can switch the password and token assignment check on or off.
Found a real key?
Redacting it here protects what you are about to share, but if the key was ever committed or posted, treat it as exposed: revoke or rotate it with the provider, then update your app. Removing it from the latest version of a file does not remove it from history.
Good habits
- Keep keys in environment variables or a secrets manager, not in code.
- Add a .env example file with placeholders so others know what to set.
- Keep real .env files out of your repository with a gitignore.
- Scan logs and tickets before you paste them into a chat or a public issue.
- Check a live site for exposed keys and files with the pre-launch scan.
Who uses it
Developers sharing a snippet or asking for help, support teams pasting logs into a ticket, students publishing a project, and small teams checking a config before a launch.
Private by design
This page is not allowed to make network requests, so the text you paste cannot be sent anywhere. Matches are shown partly masked.
Questions
Does a clean scan mean I am safe?
No. It finds common formats and likely secrets, but no scanner catches everything. Review sensitive text yourself.
Will it find passwords in plain text?
It flags values assigned to names like password or secret when they look random enough to be real. Short or obvious words may not be flagged.
Is my code uploaded?
No. The scan runs in your browser.