How to use: Secret Scanner
Secret Scanner is a free online Security Tools tool that find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code instantly in your browser. Paste your data, adjust the options and get the result in real time — no installation, no sign-up, and nothing is ever uploaded to a server.
Description
Find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code.
- Security Tools
- Because everything is computed client-side, Secret Scanner is safe to use with sensitive data such as API keys, tokens or private logs.
How to use
Using Secret Scanner takes three steps:
- Paste your data into the input box (or load the example).
- Configure the options to match your target format or scenario.
- Copy, download or inspect the output — it updates live as you type.
Run
Examples
A deliberately fake credential set in the shapes scanners look for. Replace with your own config or log text.
Input
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY STRIPE_KEY=sk_live_4eC39HqLyjWDarjtT1zdp7dc DATABASE_URL=postgres://user:pass@db.internal:5432/app -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEA... -----END RSA PRIVATE KEY-----
Output
⚠ 5 potential secret(s) found across 5 pattern(s):
AWS access key ID (1)
line 1 AKIAIO…MPLE (20 chars)
AWS secret access key (1)
line 2 AWS_SE…EKEY (62 chars)
Stripe secret key (1)
line 3 sk_liv…p7dc (32 chars)
Private key block (1)
line 5 -----B…---- (31 chars)
Database connection string (1)
line 4 postgr…/app (41 chars)
Remediation
1. Rotate every credential listed above — treat it as compromised.
2. Purge it from git history (git filter-repo or BFG), not just the working tree.
3. Move secrets to a vault or CI secret store; keep .env out of version control.
4. Add a pre-commit secret scanner so this cannot happen again.
This output was produced by actually running the tool, not written by hand.
Use cases
Common situations where Secret Scanner helps:
- Find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code.
Parameters
This tool has no options — it works on the input alone.
FAQ
What is Secret Scanner?
Secret Scanner find leaked API keys, tokens, private keys, JWTs and connection strings in config files, logs or code. It runs entirely in your browser, so your data stays private.
Is Secret Scanner free to use?
Yes. Secret Scanner is free, unlimited and works without registration or installation.
Does my data get uploaded?
No. All processing happens locally in your browser; nothing is sent to any server.
Good to know
- Everything runs client-side, so extremely large inputs are limited by your browser tab’s memory rather than by a server upload limit.