Secret scanner
Find likely exposed credentials without revealing their values.
Your input stays on this device. Nothing is uploaded or saved.
About Secret scanner
Find likely exposed credentials in pasted source, logs or configuration without sending the text from your browser.
When to use it
Check an agent generated configuration before sharing it.
A token assignment → provider, masked value, line and columnHow to use it
- Paste the text you want to check.
- Inspect masked findings with provider names and source locations.
- Revoke confirmed exposed credentials at their provider, then remove them from the source.
Review findings without exposing another copy
The scanner recognizes common cloud access keys, source control tokens, payment secrets, AI keys, Slack and SendGrid credentials, JWTs, private key headers and credential assignments. Findings include a masked value and source location. The full matching value is excluded from results, downloads and workspace activity.
Web scans run locally in your browser. API, SDK, CLI and MCP calls use the same patterns on the server without retaining input. Pattern checks can miss unusual or split secrets and can flag fixtures that only look real. If a finding is a live credential, revoke it at its provider; deleting it from a file does not invalidate an exposed key.
Limits & privacy
64 KiB text and up to 100 reported findings. Browser execution is local. Hosted input is not logged or retained. Findings never include a complete secret. Pattern checks cover common cloud, payment, source control and AI tokens, JWTs and private keys; no findings does not prove the text is safe.
Use this tool from the API reference or connect through the SDK, CLI, SSH, or MCP. Hosted calls share your plan allowances.