Secrets Scanner

1. Paste the content you want to share (code, log, JSON, .env, headers, URL, HAR snippet).
2. Pick a preset (commit safety, ticket / PR, LLM-prompt safe, log share). The preset chooses the per-severity redaction strategy.
3. Optionally toggle the high-entropy scan and key-name boost.
4. Read the verdict, then open the Findings tab to review each detection — type, severity, and location.
5. Copy or download the sanitized output, or hand it off to another tool.
6. If a real secret was detected, rotate it immediately at the provider — detection is not remediation.

• Before pasting a config or log into a Slack / Teams / Discord channel.
• Before attaching a file to a Jira / Linear / GitHub ticket.
• Before sharing a sample with a teammate, vendor, or support engineer.
• Before sending a snippet to an AI assistant (ChatGPT, Claude, Copilot).
• Pre-commit: paste the diff to check for accidental tokens.
• After an incident: scan the leaked artifact to confirm what was exposed.

• Authentication & OAuth tokens: JWT, Bearer, Basic auth, access / refresh / id tokens, client_secret, session and CSRF tokens.
• Cloud credentials: AWS access key ID / secret / session token, Azure connection strings, Google API keys, GCP service-account private keys.
• Provider-specific keys: OpenAI, GitHub (classic & fine-grained), GitLab, Slack, Stripe, SendGrid, Twilio, Mailgun, NPM, PyPI, Datadog, Sentry DSN, Cloudflare-like, Heroku, Docker.
• Passwords: password / passwd / pwd / db_password / smtp_password / keystore_password assignments in code or config.
• Private keys & cryptographic material: PEM-encoded private keys (RSA / EC / DSA / OpenSSH / PGP), SSH key payloads.
• Connection strings: PostgreSQL, MySQL, MongoDB, Redis, AMQP, SMTP, JDBC, S3 / Azure storage with credentials.
• Cookies & sessions: Cookie / Set-Cookie headers, JSESSIONID, PHPSESSID, connect.sid, remember_token.
• URL query secrets: access_token, id_token, refresh_token, code, client_secret, api_key, token, sig, signature, X-Amz-Signature, signed URLs.
• Unknown high-entropy strings: opaque base64 / hex / random-looking values with key-name context boosts.

• Replace with a typed placeholder ([AWS_ACCESS_KEY_REDACTED]).
• Mask while preserving a small prefix and suffix (sk_live_****3456).
• Remove the value entirely (keys / headers stay intact).
• Consistent token — the same secret maps to token_001 within the run, so logs stay correlatable without exposing real values.
• Hash the value with a local non-crypto digest. Treat as fingerprint only — hashing low-entropy values is reversible by guessing.
• Format-preserving mask — keeps provider prefixes (AKIA…EXAMPLE) or URL structure where useful.

Each preset chooses which strategy to apply per severity — for example the strict preset replaces everything, while the debug-tokenize preset maps each secret to a stable token.

JSON values are scanned and the output is re-serialized as valid JSON. .env / properties keep keys and comments while values are masked. HTTP headers preserve names; Set-Cookie values are masked while attributes are kept. URLs keep host / path / non-secret parameters and only mask secret query values. HAR snippets, XML/SOAP, and YAML fall back to text-level redaction with structure preserved on a best-effort basis — for full HAR cleanup, use the HAR Sanitizer.

• Rotate or revoke the secret immediately at the provider — detection alone is not remediation.
• Check audit / access logs for suspicious use.
• If the secret was committed to Git, rewrite history (e.g. git filter-repo) and force-push — and assume the secret is compromised.
• Move secrets to a secret manager (AWS Secrets Manager, GCP Secret Manager, Vault, 1Password, etc.) and inject them as environment variables at runtime.
• Scope credentials minimally and prefer short-lived tokens.

FAQ

• Does this upload my data? No. Detection, redaction, tokenization, and hashing all happen in your browser. There are no network calls, no AI calls, and no provider validation.
• Is this a replacement for GitHub secret scanning or enterprise DLP? No. This is a pre-share developer helper. Use it before pasting into tickets, chat, AI prompts, or screenshots — not as a compliance control.
• Why are there false positives? Pattern-based detection trades coverage for noise. UUIDs, hashes, base64 blobs, and request IDs can trip entropy heuristics. Turn off the high-entropy scan to reduce noise.
• Why is client_id not flagged but client_secret is? Client IDs are usually public identifiers; client secrets are credentials and must never be shared.
• Can it scan .env files without breaking them? Yes. Keys and comments stay; only values are masked / removed / tokenized.

Runs locally in your browser. No uploads. No analytics on pasted content. Pattern-based scanning can miss secrets and produce false positives — always review findings before sharing.

• Find secrets and API keys in config files