Secrets Scanner

How it works

The scanner runs a fixed list of regular expressions against your pasted text, matching the same publicly-documented secret formats that tools like gitleaks and truffleHog look for — AWS access key IDs always start with AKIA, GitHub tokens with ghp_/gho_/ghu_/etc., Stripe live keys with sk_live_, Slack tokens with xox, and PEM private keys with their fixed BEGIN header line — plus generic patterns for connection strings with embedded credentials and key=value assignments that look like secrets. Every character stays in your browser: the scan is plain JavaScript running against the textarea's value, with no network request involved at any point.

FAQ

Does anything I paste get sent to a server?

No — the entire scan runs in JavaScript in your browser using regular expressions against the text in the textarea; nothing you type or paste is transmitted anywhere, which matters more here than on most tools since you're pasting live credentials.

Will it catch every possible secret, like a custom internal API key format?

No — it only flags known, publicly-documented formats (AWS, GitHub, Stripe, Slack, PEM keys) plus generic connection-string and key=value patterns; an internal secret with no recognizable prefix or shape can slip through undetected.