Secret & API Key Scanner
Paste code, environment files, or logs and check for exposed provider keys, tokens, private keys, and hardcoded credentials before you commit or share.
How the scan works
The scanner splits your input into lines and runs a set of regular expressions over each one. Some rules match exact provider formats that almost never produce a false positive, such as an AWS access key id that starts with AKIA, a Stripe sk_live_ key, a GitHub ghp_ token, or a -----BEGIN PRIVATE KEY----- header. Those are flagged high. Other rules are heuristics: a long hex or base64 string, or a password = "..." style assignment. Those are flagged medium because they are often but not always real. Each hit is shown with its line number and a masked preview that keeps only the first and last four characters. Nothing leaves the page, so it is safe to check a private repository or a production log. When something matches, rotate the credential, move it to a secret manager, and clean it from git history. Next, tidy config with the YAML to JSON converter or browse the tools hub.