Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords. Everything runs locally in your browser — nothing is uploaded.
Full-featured API client that runs in your browser — make HTTP requests, edit headers/body/params, save collections, generate code snippets (cURL/Fetch/Axios). Your API keys never touch a server — everything runs locally.
Hash API keys using SHA-256 for secure storage. Never store raw API keys — hash them before persisting to your database.
Generate cryptographically secure random tokens in hex, base64, or alphanumeric format. Perfect for API keys, session tokens, and secrets. Everything runs locally in your browser — nothing is uploaded.
Converts alphanumeric text into International Morse code with audible beeps played through the Web Audio API, and decodes incoming Morse signals. Everything runs locally in your browser — nothing is uploaded.
Convert Markdown formatting to Slack mrkdwn syntax — bold, italic, links, code blocks, and lists translated automatically.
Secret Scanner lets you scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords. Everything runs locally in your browser — nothing is uploaded.. It works on any device with a modern web browser.
Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords. Everything runs locally in your browser — nothing is uploaded. It runs entirely in your browser — no software installation or data uploads required.
Paste or type your content directly into the provided text area.
Yes. After the initial page load, Secret Scanner runs entirely on your device with no internet connection needed. All processing is done locally.
Stripe API keys, GitHub/GitLab tokens, Slack tokens, AWS access keys, Google API keys, OpenAI keys, JWT tokens, private keys (PEM), database connection strings, and hardcoded passwords in config files.
Review each flagged item. If it's a real credential, rotate it immediately in the respective service's dashboard. Remove the secret from code and use environment variables or a secrets manager instead.
Yes. Paste the contents of any file — .env, docker-compose.yml, kubernetes manifests, config files, or source code. The scanner checks for patterns matching known secret formats.
The scanner uses regex patterns that may flag placeholder values (e.g., 'YOUR_API_KEY_HERE'). Always verify flagged items manually before rotating credentials.
No. All scanning happens locally in your browser. No code or detected secrets are sent to any server.