API Secret Leak Scanner
Scan pasted code and configs for exposed API keys and tokens (AWS, GitHub, Slack, Google, Stripe, JWT, private keys) with bundled offline regex patterns and masked output.
Loading tool...
What is API Secret Leak Scanner?
The API Secret Leak Scanner checks pasted code and configs against bundled offline regex patterns for AWS keys, GitHub tokens, Slack tokens, Google API keys, Stripe live keys, JWTs, private key blocks, and generic credential assignments - reporting line numbers, severity, and masked samples so nothing sensitive is echoed back.
Key Benefits
- Catch leaked credentials before a push, share, or deploy
- Line-numbered findings with severity badges
- Masked samples keep full secrets off your screen
- Runs offline - safe even for your most sensitive files
Common Use Cases
- •Auditing files before the first commit of a project
- •Checking .env exports, CI logs, and shell histories
- •Reviewing config dumps shared by teammates
- •Cleaning repos before open-sourcing them
- •Teaching teams what credential formats look like
Scan Code for Exposed Secrets
- Paste the code or config: Paste the file you are about to commit or share - .env contents, scripts, YAML, anything with credentials.
- Review the findings: Each finding shows the pattern name, a severity badge, a masked sample, and the line number.
- Rotate what you find: Treat every finding as live: revoke the credential at its provider, issue a new one, and never reuse the exposed value.
- Re-scan until clean: Remove or move the secrets to environment variables and re-scan until the report comes back clean.
Key Features
- Bundled patterns for AWS, GitHub, Slack, Google, Stripe, JWTs, and private keys
- Line-numbered findings with severity badges
- Samples are masked - full secrets are never echoed back
- Generic assignment detection for keys, secrets, tokens, and passwords
- Live scanning on every keystroke, no upload
- Runs fully offline - safe even for sensitive code