Secret Scanner

What is Secret Scanner?

Secret Scanner analyzes text, code, and configuration files for accidentally exposed secrets using over 20 regex patterns matched against known credential formats. It detects AWS access keys, GitHub tokens, Stripe API keys, database connection strings, private RSA keys, JWT secrets, Slack tokens, Google API keys, and more. Each detection includes the secret type, line number, and remediation guidance.

Security engineers performing code audits, developers reviewing changes before commit, and DevOps teams implementing credential scanning in CI/CD pipelines. The tool runs entirely in your browser — your data never leaves your device.

How to Use Secret Scanner

1. Paste the text, code, or configuration content you want to scan
2. Click Scan to analyze the content against all secret detection patterns
3. Review the findings list with detected secret types and line numbers
4. Click on any finding to highlight the matched text in the editor
5. Follow the remediation guidance to rotate exposed credentials and move them to secure storage

Common Use Cases

• Scanning code files before committing to catch accidentally hardcoded API keys
• Auditing configuration files for exposed credentials that should be in environment variables
• Reviewing pull request diffs for leaked secrets before merging to the main branch
• Scanning log output for accidentally logged authentication tokens or database passwords
• Checking documentation and README files for real credentials used in examples

Pro Tips

• AWS access keys always start with AKIA followed by 16 alphanumeric characters — if you see this pattern anywhere in your codebase, the key is likely real and should be rotated immediately
• Even if you remove a secret from your code, it remains in Git history forever — use git filter-branch or BFG Repo-Cleaner to purge it, then rotate the credential
• Set up a pre-commit hook using tools like gitleaks or detect-secrets to prevent secret commits automatically — scanning after the fact is good, but prevention is better

Why Use This Tool?

• Privacy-first: All processing happens locally in your browser. No data is transmitted to any server.
• No installation required: Works in any modern browser on desktop or mobile.
• Completely free: No account, no credit card, no usage caps.
• Fast and reliable: Powered by modern Web APIs for near-instant results.

Related Concepts

Learn more about related topics: gitleaks, git-secrets, Credential rotation, Secrets management.

Frequently Asked Questions