Free Secret Scanner · Find API Keys in Code
Paste any code, config, or bundle excerpt and get flagged secrets · AWS keys, Stripe live keys, OpenAI keys, GitHub tokens, JWTs, private key blocks and more.
Frequently asked
Which secret formats are detected?
High-signal prefixes and structures: AKIA (AWS), sk_live_/rk_live_ (Stripe), sk- and sk-proj- (OpenAI), ghp_/gho_ (GitHub), AIza (Google), xox (Slack), eyJ JWTs including Supabase service-role tokens, PEM private key blocks, and generic high-entropy assignments.
I found a real key in my code · what now?
Rotate it immediately (the finding means it's compromised, not just risky), move the new key server-side, and scrub git history if it was committed. Then scan your deployed app · the same key may be live in your bundle right now.
Related tools
- .env File Linter · Paste your .env and get instant findings · secrets that will ship to the browser, duplicate keys, quoting problems · plus a generated .env.example.
- JWT Debugger · Paste a JSON Web Token to decode its header and payload · and get flagged for alg:none, weak algorithms, missing expiry, and sensitive claims.
- CSP Evaluator · Paste a Content-Security-Policy and get an A-F grade · with specific fixes for unsafe-inline, unsafe-eval, wildcards, and missing directives.