SECURITY

Secret Scanner

30 patterns for leaked AWS/GitHub/Stripe/Slack/database-connection-string secrets and more, with line numbers, severity, a redacted-copy export, and high-entropy catch-all detection -- heuristic, not exhaustive.

What this tool does

Scans pasted text or code against 30 patterns matching the real, publicly documented shapes of leaked credentials -- the same kind of heuristic matching tools like gitleaks and truffleHog use -- and reports every hit with its line number, severity, and a redacted preview safe to glance at without re-exposing the full secret.

What's covered

Cloud credentials (AWS access keys and session tokens, Google API keys and OAuth secrets, Azure storage keys), source-control tokens (GitHub classic/OAuth/App/fine-grained PATs, GitLab PATs), payment and messaging services (Stripe, SendGrid, Twilio, Slack tokens and webhooks, Discord bot tokens, Mailgun), package-registry tokens (npm, PyPI), PEM private key headers, JWTs, database connection strings with embedded credentials (postgres://user:pass@...), Basic Auth embedded in a URL, and generic api_key=/secret=/ password= assignments.

High-entropy catch-all

Beyond named patterns, any long base64/hex-looking string with Shannon entropy above a realistic threshold for random data gets flagged too -- catching custom or unrecognized secret formats that don't match a known service's shape but still look like genuinely random key material rather than ordinary text.

Severity, not just a yes/no

Findings are ranked critical/high/medium/low based on how specific and dangerous the pattern is -- an AWS access key or a database connection string with embedded credentials is critical; a generic password= assignment (which catches plenty of harmless test fixtures) is flagged lower.

Redacted copy

One click produces a copy of the input with every detected secret masked (first/last few characters kept, the middle replaced) -- safe to paste into a bug report, a Slack message, or an issue tracker without re-leaking what you just found.

Why this is heuristic, not exhaustive

Regex pattern matching cannot catch every possible secret format, and it will occasionally flag a placeholder or test value that happens to match a pattern's shape. Treat a clean scan as "no known pattern matched," not a guarantee nothing sensitive is present -- and a flagged match as "worth a closer look," not automatically a real leaked credential.

Privacy

Everything is scanned entirely in your browser. Nothing is uploaded -- which matters, since the whole point is not sending your actual secrets anywhere else either.

FAQ

Frequently asked questions

Is this as thorough as gitleaks or truffleHog?

It uses the same general approach (pattern matching against known secret shapes, plus entropy-based detection for unknown formats) but with a smaller, browser-friendly pattern set -- 30 patterns here versus hundreds in a dedicated CLI scanner. Use this for a quick check on a paste; use a dedicated scanner for a full repository audit.

Why does a clean scan not guarantee nothing is leaked?

Regex pattern matching can only catch secret formats it has a pattern for -- a custom or unusual format, or a secret embedded in a way the patterns don't anticipate, can slip through. A clean result means "no known pattern matched," not "nothing sensitive is present."

Why are some findings flagged lower severity than others?

Specificity: an AWS access key ID or a database connection string with embedded credentials is almost never a false positive, so it's critical. A generic password= assignment catches plenty of harmless test fixtures and placeholder values too, so it's flagged lower to reflect that uncertainty.

What is the high-entropy catch-all for?

Named patterns only catch formats this tool specifically knows about. The entropy check flags any long base64/hex-looking string that's random enough to plausibly be a key or token, even if it doesn't match a known service's exact shape -- a useful catch-all for custom or unrecognized secrets.

What does the redacted copy actually hide?

Every detected match is replaced with its first and last few characters plus a run of bullet characters in between -- enough to recognize what type of value it was without exposing enough to actually use it, safe to paste into a bug report or chat message.

Can I trust a flagged match to actually be a real secret?

Not automatically -- a match means the text matches a known secret's shape, not that it's confirmed live and valid. Treat every finding as "worth checking," especially the lower-severity generic patterns, which flag plenty of harmless placeholders too.

Should I paste my actual secrets in here to check them?

The scan runs entirely in your browser and nothing is uploaded, so it's safe to do -- but as a general habit, treat any tool (including this one) that could see a real secret as a reason to rotate that secret afterward if you're ever unsure.

Is anything I paste sent anywhere?

No. Scanning happens entirely in your browser -- this tool has no server component, which matters doubly here since the whole point is not sending real secrets anywhere else either.