Secret Scanner | Find Leaked API Keys in Code

Secret scanner that finds leaked API keys, tokens and private keys in pasted code. 28 rules for AWS, GitHub, Stripe, OpenAI and more. Nothing is uploaded. Designed specifically for developers and professionals, this free online analyzer runs entirely in your browser to process tasks quickly and securely. Enjoy unlimited usage with no data tracking and no registration required.

Also known as: secret scanner online · api key scanner · find api keys in code · scan code for secrets · leaked api key checker · hardcoded credentials detector · gitleaks online · secrets detection tool · detect aws keys in code

ssl and security tools

api and http tools

developer utilities

analyzers

Code Input

Findings

Findings will appear here with a severity, the rule that matched, its line and column, and a redacted preview of the value.

About Secret Scanner

Secret Scanner finds hardcoded credentials in code before they reach a repository: cloud keys, API tokens, database passwords and private keys. Paste a file, a diff, a CI log or git log -p output and every match comes back with a severity, the rule that caught it, its exact line and column, and a redacted preview. The scan runs in your browser, so the code you are checking is never uploaded anywhere.

Key Features

28 detection rules covering AWS, GitHub, GitLab, Stripe, OpenAI, Anthropic, Google, Slack, SendGrid, npm, PyPI, Azure, Shopify and more
Validates the CRC32 checksum built into GitHub tokens, so a random ghp_ string is marked as fake
Catches database URLs with an inline password for Postgres, MySQL, MongoDB, Redis and AMQP
Filters generic password and token assignments by Shannon entropy to cut false positives
Skips placeholders, environment lookups and lines marked gitleaks:allow
Redacts every value by default, and copy and download only ever export the redacted report

Use Cases

Check a config file before pasting it into a GitHub issue, a Slack thread or a support ticket
Scan the output of git log -p on a branch before opening a pull request to a public repo
Review an .mcp.json or agent config for inline OpenAI and Anthropic keys
Audit a CI log that printed environment variables during a failed deploy to us-east-1
Spot-check a contractor's code drop for credentials during a SOC 2 or HIPAA review
Confirm a cleanup commit actually removed every key, not just the one someone noticed

Supported Formats

Source code (JS, TS, Python, Go, Java, Ruby)

.env and .ini files

JSON, YAML and TOML config

Terraform (.tf)

git log -p and diff output

CI and application logs

Related Keywords

secret scanner online

api key scanner

find api keys in code

scan code for secrets

leaked api key checker

hardcoded credentials detector

gitleaks online

secrets detection tool

detect aws keys in code

What should you do if the scanner finds a real API key?

Revoke it at the provider first, then clean up. Deleting the line or rewriting git history does not un-leak a key, because it already sits in every clone, in CI caches and in anything a scraper copied after the push. Rotate the credential in the AWS, GitHub or Stripe console, confirm the old one is rejected, and only then remove it from the code. For a full repository history, run Gitleaks, Betterleaks or TruffleHog locally, since this tool scans only what you paste.

Privacy & Security

All processing happens locally in your browser. Your data never leaves your computer, ensuring complete privacy and security.

Liked this tool?

DevToolLab is free to use. If this analyzer saved you some time today, please consider supporting our work.

Buy us a coffee ☕

Frequently asked questions

What is Secret Scanner used for?

Secret scanner that finds leaked API keys, tokens and private keys in pasted code. 28 rules for AWS, GitHub, Stripe, OpenAI and more. Nothing is uploaded.

Is Secret Scanner free to use?

Yes. Secret Scanner is completely free with no usage limits, and there is no paid tier required to use it.

Do I need an account to use Secret Scanner?

No. Secret Scanner works immediately in your browser with no signup, login, or email address required.

Related Tools

Word & Character Counter Online | Word Counter

Count words, characters, sentences, paragraphs and lines in your text. Analyze letter density and reading time instantly.

text tools

date and time tools

URL Parser | URL Analyzer Online

URL parser - extract protocol, host, path, query parameters, and hash fragments. Free, no signup, works instantly online.

hashing and checksum tools

url and link tools

User Agent Parser | Analyze Browser & OS Online Free

Parse and analyze user agent strings to detect browser, operating system, device type, and bot information. Essential for web debugging.

text tools

code formatters and minifiers

More Tools You Might Like

Pastebin Online | Share Code & Text Snippets Free

Popular

Share code snippets, logs, and text with a shareable link. Syntax highlighting for 30+ languages, expiration controls, and password protection for Pro users.

text tools

password and key generators

math calculators

utilities

Use Tool

URL Tracker & Link Shortener | Track Clicks

Popular

Create short, trackable URLs with detailed click analytics. Track visitor location, devices, referrers, and more. Password protection & QR codes included.

text tools

password and key generators

url and link tools

networking

Use Tool

Webhook Receiver & Inspector | Test HTTP Webhooks

Popular

Generate a unique URL to easily test, receive and inspect HTTP webhooks in real-time. View request headers, query parameters, JSON payloads, and more.