日本語English

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

On-device・No upload

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Drop files (several allowed)

or

Text, code, .env and config files. Files are not uploaded.Paste (Ctrl+V) also works
Paste text or add files and results will appear here.

How to use

  1. Paste text, or drop files (several at once) / click “Choose files”. “Try a sample” shows how it works.

  2. Findings are listed by severity with file, line, column and rule. Values are masked.

  3. Turn on “Show values” if you need to see them (on screen only; reports never include them).

  4. Adjust the high-entropy threshold, or turn that rule off if you get too many false positives.

  5. Save a CSV or JSON report, or a “Redacted copy” with every detected value replaced by ***.

What it does

Dedicated rules for common services

AWS access keys, GitHub and GitLab tokens, Slack tokens and webhooks, Stripe, Google API keys, OpenAI/Anthropic-style keys, JWTs and PEM private keys each have their own pattern.

Assignments and connection strings

Catches password= / api_key: style assignments and the password inside postgres://, mysql://, mongodb:// and similar URLs. Placeholders such as ${VAR} or <your-key> are ignored.

Entropy for unknown secrets

Random-looking strings of 24+ characters are flagged by Shannon entropy (default 4.2 bits/char, 3.6 for hex). UUIDs and plain words are skipped. The threshold is adjustable.

Masked by default

The list and the CSV/JSON reports contain only masked values. “Show values” is a screen-only convenience and never changes what you save.

Redacted copy

Saves the file with only the detected values replaced by ***; one file downloads directly, several as a ZIP. Everything else is left untouched.

Use cases

  • Check config files for leftover API keys before pushing to GitHub
  • Strip tokens and passwords from logs or configs before sharing them outside your team
  • Make sure a .env or docker-compose.yml sample holds no real values
  • Remove credentials from a code snippet before pasting it into an AI assistant

Capability matrix

FeatureSupportNotes
Pasted text and multiple filesSupported—
Keys, private keys and JWTs of common servicesSupported—
Password assignments and DB connection stringsSupported—
Entropy-based candidates for unknown secretsPartialExpect false positives and misses
Redacted copy with *** in place of detected valuesSupported—
Scanning inside ZIPs or binary filesNot supportedBinary files are skipped
Scanning Git history or revoking secretsNot supported—
Checking whether a found secret is still validNot supportedNo network requests are made

Limits & notes

  • This is a helper. It does not guarantee that nothing is missed, nor that every finding is a real secret. Review the result yourself before publishing.
  • Up to 5 MB per file, 200 files and 5,000 findings. Binary files (containing NUL bytes) are skipped.
  • Files are read as UTF-8; Shift_JIS and other encodings may be garbled and missed.
  • A secret that was ever published must be revoked (rotated) at its issuer; deleting the text is not enough.

Privacy & safety

Pasted text and files are scanned only inside your browser. Nothing is sent to or stored on a server, and usage analytics never include content or file names.

FAQ

Is it safe to paste real config files?
Scanning runs entirely in your browser and makes no network requests, so sensitive files stay on your device.
Does “no findings” mean it is safe?
No. Custom key formats and unusual notations are not detected. Use it as an aid and also review manually and scan your Git history.
What if I get too many false positives?
Turn off the high-entropy rule or raise its threshold. Hashes and build IDs can look like tokens.
I already pushed a secret to GitHub. What now?
Revoke it and issue a new one first — it may have been copied even if you remove it from history.
Does the redacted copy overwrite my file?
No. Your original is untouched; the redacted content is saved as a new file.

Related tools

Crypto Studio — Hash, HMAC, Encryption & Keys

Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.

Password Studio — Generator & Strength Checker

A strong 20-character password is ready when the page opens. Fine-tune symbols and excluded characters, switch to a memorable passphrase, or check a password you already use — all without sending anything off your device.

Share Safe

Before you hand a file over, see what is hiding in it — listed per file with severity — and get a safe copy with everything removable removed. The copy is re-checked afterwards, and whatever is left comes with manual steps. Files are never uploaded.

Last updated: