Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords. Code never leaves your device — formatting and validation run locally in your browser.
Content reviewed October 2026 · About Toolzum
Hunt IPs, API keys, emails, and URLs across thousands of logs or code files — extract matches or replace in place. SREs scrub 5,000 logs before sharing — local JS RegExp, 2 free batches a day.
Decode and inspect JWT tokens — view header, payload, expiration, issuer, subject, and other standard claims. Paste an HMAC secret to genuinely verify HS256/384/512 signatures — local inspection, free, no signup.
Generate RSA key pairs (2048/4096-bit) using the Web Crypto API. Export public and private keys as PEM strings. All client-side, no server uploads.
Preview your text in 6 Google fonts — Inter, Playfair Display, Fira Code, Pacifico, Outfit, and Montserrat — and copy the ready-to-use CSS import plus font-family rule. Free, local, no signup.
Share secrets securely via self-decrypting note links — AES ciphertext in the URL fragment, key in the link query. Send passwords without trusting inboxes — local crypto-js AES, free, no signup.
Stripe API keys, GitHub/GitLab tokens, Slack tokens, AWS access keys, Google API keys, OpenAI keys, JWT tokens, private keys (PEM), database connection strings, and hardcoded passwords in config files.
Review each flagged item. If it's a real credential, rotate it immediately in the respective service's dashboard. Remove the secret from code and use environment variables or a secrets manager instead.
Yes. Paste the contents of any file — .env, docker-compose.yml, kubernetes manifests, config files, or source code. The scanner checks for patterns matching known secret formats.
The scanner uses regex patterns that may flag placeholder values (e.g., 'YOUR_API_KEY_HERE'). Always verify flagged items manually before rotating credentials.
No. All scanning happens locally in your browser. No code or detected secrets are sent to any server.
SQL Injection Detector
Scan inputs and queries for SQL injection patterns — tautologies, unions, stacked queries. Catch ' OR '1'='1 before attackers do — local pattern matching, free, no signup.
API Key Hasher
Hash API keys using SHA-256 for secure storage. Never store raw API keys — hash them before persisting to your database.