Secret Scanner
Processing: Browser. Processed entirely in your browser — this input never leaves your device.Paste text to scan for likely secrets — processed entirely in your browser by default. Findings are redacted; the full value is never shown or sent anywhere unless you explicitly switch to API mode.
How to use it
- Paste text (config, code, logs) into the box.
- Findings appear automatically — browser mode never sends anything anywhere.
- Switch to API mode only if you specifically need server-side scanning (e.g. matching CI behavior).
Example
Select “Use example” above to load sample text containing an obviously-fake AWS key and a weak default password.
Privacy and security
- Browser mode (default): processing happens entirely client-side. Nothing is sent to our servers.
- API mode (opt-in, clearly labeled): input is sent to our server to scan, then discarded — never persisted or logged.
- No LLM is used — detection is deterministic pattern/context/entropy matching only.
- Findings never include the full matched value, in either mode.
Limitations
- Deterministic detection has both false positives and false negatives — treat every finding as “potential,” not confirmed.
- Entropy-based findings are capped at low confidence and are the most likely to be false positives.
- Input is capped at 256 KB.
FAQ
Does this ever show me the full secret it finds?
No. Every finding shows a redacted representation (e.g. AKIA••••••••Q7DF) computed at the moment of detection — the full matched value is never assigned anywhere it could be returned, logged, or displayed.
What does "Scan in browser" actually mean?
Your pasted text is scanned entirely by JavaScript running in your browser tab. Nothing is sent to our servers, and nothing is stored — refreshing the page clears it.
When would I use the API mode instead?
For scripts, CI pipelines, or agents that want the same deterministic scanning without a browser. Submitting via the API does send your input to our server for processing — the toggle says so explicitly, and it is off by default.
Does it use an LLM to detect secrets?
No — deterministic pattern, contextual key-name, and entropy-based detection only. No AI model ever sees your input.
Will it flag everything, even placeholders?
No — obvious placeholders (e.g. "changeme", "your_api_key_here") are excluded from the contextual check to reduce false positives.