Overview
Paste a .env file, code snippet or CI log and this scanner finds credential-shaped strings before they ship: API keys for OpenAI, Anthropic, Google, DeepSeek, Groq, xAI, Perplexity, HuggingFace, AWS, GitHub, Stripe, Slack, Supabase, Telegram and Twilio, plus private key blocks and generic secret assignments. Findings are masked, severity-rated and line-numbered. Every check runs locally - your paste never leaves the browser.
How It Works
Paste the text into the editor. Findings appear immediately, each with a severity (critical, high or medium), the kind of credential detected, a masked preview showing only the first five and last four characters, the line number, and specific remediation advice such as which provider dashboard to revoke in. If nothing matches, the page says so and reminds you to still run a scanner like gitleaks in CI. There is no scan button and no upload step - detection happens as you type.
Step-by-Step Usage Guide
- Paste the .env file, source code or log into the editor.
- Review each finding's severity, kind, masked value and line number.
- Follow the per-provider advice to revoke and rotate every real match.
- Re-run the scan after remediation until the page reports no findings.
Technical Specifications & Standards
Detection is a set of seventeen provider-specific regular expressions, each carrying a severity and tailored advice. Patterns anchor on known prefixes: sk- and sk-proj- for OpenAI, sk-ant- for Anthropic, AIza plus 35 characters for Google, AKIA plus 16 characters for AWS access keys, ghp/gho/ghu/ghs for GitHub tokens, sk_live_ and rk_live_ for Stripe, BEGIN PRIVATE KEY blocks for PEM keys, and a generic secret-or-password assignment pattern as the net below. Two filters keep the report honest: obvious placeholders such as REDACTED, XXXX or template variables are skipped, and the low-severity generic pattern must clear a Shannon entropy threshold of 3.2 bits per character, which weeds out dummy values like password123 while keeping high-entropy real secrets. Masking uses first-five, asterisks, last-four so findings can be discussed without echoing the secret. This checks format, not validity - a match means rotate and investigate, not proof the key is live.
Targeted Use Cases
- Checking a .env file before committing it to a repository.
- Auditing old CI logs or paste-bin snippets that may have leaked keys.
- Onboarding review: showing a junior developer what credential-shaped strings look like.
- Post-incident triage of a file that was pushed to a public repo.
Notes & Gotchas
- Treat every finding as compromised until rotated - format matching is presumptive evidence.
- Use the masked preview and line number to locate secrets without copying them.
- Run a repo-history scanner too; this tool checks pasted text, not git history.
- Keep the tool open while writing .env templates to catch placeholders early.
Frequently Asked Questions
Does my pasted code leave my browser?
No. Scanning is regular expressions executed in your browser. There is no network call, no logging and no storage of the pasted text.
A match appeared - is the key definitely live?
Unknown. The scanner validates the shape of the string, not whether it still authenticates. Treat any match as compromised until you have revoked and rotated it at the provider.
Why are findings masked?
So you can verify which variable was flagged without the full secret appearing in screenshots, screen shares or chat. The mask shows the first five and last four characters only.
It found nothing - am I safe?
Probably not entirely. The tool only knows seventeen patterns and skips obvious placeholders. A clean result justifies moving on to a purpose-built repo scanner such as gitleaks in CI.