API Key & Secret Scanner — Find and Redact Leaked Keys

Find leaked API keys, tokens, passwords and private keys in code, logs or prompts, then copy a redacted version. Free, 100% in-browser — nothing is uploaded.

Runs entirely in your browser — no data is uploaded.

Scanning runs entirely in your browser. Your text is never uploaded, stored, or sent anywhere — which is the point of checking it before you paste it into an AI chat.

Paste text above. API keys, tokens, private keys and passwords are highlighted as you type.

What it does

Paste code, a config file, a stack trace, or a prompt you're about to send to an AI chat, and this scanner highlights anything that looks like a credential: API keys, access tokens, private keys, webhook URLs, database passwords. Then it gives you a safe-to-share copy with each secret swapped for a placeholder like [REDACTED_OPENAI_KEY], so the AI still understands the structure without ever seeing the key.

How it works

Two layers, the same approach open-source scanners like gitleaks use:

Known formats. Many providers give their keys a fixed prefix — ghp_ for GitHub, sk-ant- for Anthropic, AKIA for AWS, AIza for Google, xoxb- for Slack. These are matched exactly and marked high risk.
Secret-looking assignments. Lines like api_key = "…" or "client_secret": "…" are flagged when the value looks random (high character entropy). Placeholders like your_api_key_here and references like process.env.TOKEN are skipped.

Every finding tells you why it matched, and you can untick any false positive before copying.

Good times to use it

Before pasting a .env file or error log into ChatGPT, Claude, or Gemini to ask for debugging help
Before posting a code snippet to Stack Overflow, GitHub issues, Discord, or Slack
Before sharing a screen recording or a support ticket that includes terminal output
As a quick check on a script before committing it

Limitations

Pattern matching catches the common, well-defined formats — it can't recognize every custom internal token, and a plain-English password with no label around it looks like any other word. A clean result is a good sign, not a guarantee. And if a key has already been shared, redacting it now doesn't help: revoke it and issue a new one. Our guide on what to do if you leaked an API key walks through that step by step.

Privacy

Everything runs in your browser. Nothing you paste is uploaded, logged, or stored — the page works the same with your network disconnected.

FAQ

Is it safe to paste API keys into ChatGPT? It's best not to. Chats can be stored, reviewed, used for training depending on your settings, and turned into shareable links. Our article Is it safe to paste API keys into ChatGPT? explains the actual risks and a safer workflow.

Does this check whether a key is still valid? No. Testing a key would mean sending it to the provider's servers, which defeats the purpose of a private, offline check. It only looks at the format.

Why does it show my keys masked? So the results are safe to screenshot or screen-share. The masked preview keeps enough characters for you to recognize which key it is.