Secret Scanner
Secret Scanner is a free online Security Tools tool that find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code instantly in your browser. Paste your data, adjust the options and get the result in real time — no installation, no sign-up, and nothing is ever uploaded to a server.
Description
Find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code.
- Because everything is computed client-side, Secret Scanner is safe to use with sensitive data such as API keys, tokens or private logs.
How to use
Using Secret Scanner takes three steps:
- Paste your data into the input box (or load the example).
- Configure the options to match your target format or scenario.
- Copy, download or inspect the output — it updates live as you type.
Examples
These ready-made examples show typical inputs and the exact output Secret Scanner produces for them.
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY STRIPE_KEY=sk_live_4eC39HqLyjWDarjtT1zdp7dc DATABASE_URL=postgres://user:pass@db.internal:5432/app -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEA... -----END RSA PRIVATE KEY-----
A deliberately fake credential set in the shapes scanners look for. Replace with your own config or log text.
Use cases
Common situations where Secret Scanner helps:
- Find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code.
- Because everything is computed client-side, Secret Scanner is safe to use with sensitive data such as API keys, tokens or private logs.
FAQ
What is Secret Scanner?
Secret Scanner find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code. It runs entirely in your browser, so your data stays private.
Is Secret Scanner free to use?
Yes. Secret Scanner is free, unlimited and works without registration or installation.
Does my data get uploaded?
No. All processing happens locally in your browser; nothing is sent to any server.