Secret Scanner
Scan text for common API keys, tokens, and credential patterns.
The Secret Scanner is an essential online utility designed to help developers, security professionals, and anyone handling text data to proactively identify sensitive information. Whether you're reviewing a large block of code before a commit, sanitizing log files for public sharing, or checking configuration files for accidental credential exposure, this tool provides a rapid assessment. It works by meticulously analyzing your input text against a comprehensive library of regular expressions and patterns known to represent various API keys (like AWS, Google Cloud), private tokens (GitHub, Slack), database connection strings, and other common credential formats. The typical input is any text snippet, large or small, and the output clearly highlights detected patterns, often identifying the specific type of secret found. For instance, it can detect an AKIA... pattern for an AWS Access Key ID or an ghp_... for a GitHub Personal Access Token. A crucial tip for users is to remember that while the Secret Scanner is highly effective, it relies on pattern matching. This means it may occasionally flag false positives for text that merely resembles a secret, or conversely, might not catch highly custom or obfuscated secrets. Always treat its findings as potential vulnerabilities requiring human verification and never assume a 'clean' scan means absolute security. Use it as a powerful first line of defense to prevent accidental credential leakage and bolster your security posture.
How to use Secret Scanner
Input Your Text
Paste the code, log, or document content you wish to scan into the primary text area of the Secret Scanner.
Initiate Scan
Click the "Scan Secrets" button to begin the analysis of your submitted text for potential credentials.
Review Findings
Examine the results panel, which will highlight any detected secrets and categorize them by type, such as API Key, Token, or Credential.
Action Detected Secrets
For each identified secret, verify its legitimacy and take appropriate action, like revoking the key or removing it from your text.
Clear for New Scan
Use the "Clear" button to wipe the input and results, preparing the tool for your next confidential text analysis.
Frequently Asked Questions
What types of secrets can the Secret Scanner detect?
It can detect a wide range of common secret patterns including AWS Access Keys, Google Cloud API Keys, GitHub Personal Access Tokens, Slack tokens, database connection strings, JWTs, and various other credential formats.
Is the Secret Scanner prone to false positives?
As it relies on pattern matching, some text that structurally resembles a secret but isn't one might be flagged. Always verify the detected patterns manually to confirm they are indeed legitimate secrets.
Does my input text leave my browser?
No, the Secret Scanner performs all analysis locally within your browser. Your text is never sent to our servers, ensuring your data remains private and secure.
Can the Secret Scanner find secrets in encoded or encrypted text?
The tool works on plain text. If secrets are base64 encoded, gzipped, or encrypted, the Secret Scanner will likely not detect them unless they are first decoded or decrypted before input.
How does Secret Scanner differ from a linter or static code analyzer?
While linters might warn about hardcoded strings, Secret Scanner specifically targets the patterns of known secrets. Static code analyzers are broader, focusing on code quality and security vulnerabilities beyond just secret detection. Secret Scanner is a specialized, quick-check utility.
What should I do if the Secret Scanner finds a real secret?
Immediately assess the exposure risk. If it's an API key or token, revoke it from its respective service (e.g., AWS IAM, GitHub settings) and generate a new one. Then, remove the secret from your text.