devtools.codes

Secret & API Key Scanner

RUNS LOCALLY

Scan text, a configuration file or a diff for credentials before you commit or share it. Every match is masked in the interface and in any report you download, so a finding can be pasted into an issue safely. This page carries no advertising and loads no advertising script.

Your tool input is processed locally in your browser and is not intentionally uploaded to our servers. This page carries no advertising and no third-party advertising script, so pasted credentials are never present on a page with an ad request. Advertising and analytics providers may still process normal page, device, cookie and network information on other pages.

No advertisement

This page has no ad slot at any breakpoint and loads no advertising script.

How to use it

  1. Paste the text you are about to commit, share or post — a diff, a config file, or a log excerpt.
  2. Press Scan. Detection runs against every rule in your browser, and nothing is uploaded.
  3. Work through the findings. High-confidence matches are recognised provider key formats.
  4. Rotate anything real. Removing a committed key does not revoke it — only the provider can.

A worked example

The example is a short environment file of the kind people paste into a chat window by accident. It mixes three real credential formats with an environment variable reference, a timeout value and a support email address.

Three findings are reported and three values are correctly left alone. It shows both halves of the job: catching a connection string with an inline password, and not crying wolf over ${GITHUB_TOKEN}, which is a reference rather than a secret.

Press Example in the workspace above to load it.

Questions

I have committed an API key. What should I do?

Rotate it first, before anything else. Deleting the line, amending the commit or force-pushing does not revoke the key, and anything that reached a remote should be assumed to have been read. Revoke the credential at the provider, issue a replacement, then clean the history if you need to. Rotation is the step that actually ends the exposure.

Does a clean result mean my text is definitely safe?

No. Detection is best-effort pattern matching and is not a guarantee. It recognises common provider key formats, private key blocks, connection strings and high-entropy values assigned to secret-sounding names. A credential in an unusual format, or split across lines, can pass unnoticed. Treat a clean result as one useful check rather than a clearance.

Why does this page have no advertising when other pages do?

Because you may paste a live credential into it. An advertising script is third-party code running on the same page as your input, and no placement rule would make that reasonable. The advertising script is excluded from this route entirely rather than hidden with CSS, so no request is made from this page at all.

What are low-confidence findings?

Values assigned to a secret-sounding name — api_key, password, token — that do not match a known provider format but carry enough entropy to be plausible. They are frequently false positives, such as a hash or an identifier. They are shown separately so you can check them without the real findings being buried.

Does my input leave the browser?

No. Your tool input is processed locally in your browser and is not intentionally uploaded to our servers. Advertising and analytics providers may still process normal page, device, cookie and network information. Nothing you paste is logged, stored or sent to an analytics event, and there is no account to attach it to.

Related tools