Online Tool Store
Secret Scanner
Scan pasted code or config for the shapes of leaked credentials — API keys, tokens, private keys, and connection strings — before you commit it.
This works right here on your device — nothing gets sent out.
Security & Privacy
Secret Scanner
Frontend preview — no upload or external service.
Scan findings
3 findings: an AWS access key ID on line 12, a 40-character high-entropy string on line 31, and a private key header on line 58.
How the Secret Scanner works
- Paste the file, diff, or config block you are about to commit.
- Choose a sensitivity — high catches more, and produces more false positives on hashes and test fixtures.
- Treat every finding as leaked: rotate the credential first, then remove it from the file and from git history.
The method
Detection combines two signals: known provider prefixes such as AKIA or ghp_, and Shannon entropy, which measures how random a string looks compared with ordinary words.
entropy = -Σ p(c) x log2 p(c) over the characters of the string
A base64 secret scores near 5 bits per character, while an English identifier scores around 3 — which is how random-looking strings are separated from names.
FAQ
A secret was committed. Is deleting the line enough?
No. Git history keeps the old content, and anything pushed to a shared remote should be assumed captured. Rotate the credential immediately, then rewrite history or accept it as burned.
Why does it flag hashes and test data?
Because a checksum looks statistically identical to a key. Lower the sensitivity, or accept that a scanner that never flags a fixture will also miss real keys.
Is my code uploaded when I scan?
No. Scanning happens in the page, which is the only sane arrangement for a tool you paste credentials into.
How we compare
| Feature | Online Tool Store | A command-line tool | A paid audit service |
|---|---|---|---|
| Entropy plus prefix detection | ✓ | Grep only | ✓ |
| Runs before you commit | ✓ | ✓ | After push |
| Code never leaves the browser | ✓ | ✓ | ✗ |
| Scans git history | ✗ | ✓ | ✓ |
Secret Scanner checks the file in front of you, not your history — for a repository that has already been pushed, a history-aware scanner is the right next step.