Secret Pattern Scanner

Each pattern matches the documented format of a key or token, such as the AKIA prefix of AWS access key IDs or the ghp_ prefix of GitHub tokens. Provider-specific formats are reliable and rated high; generic patterns such as JWTs, bearer tokens and password settings catch more but also produce more false positives.

A scanner that prints the secrets it finds creates a new leak: the result ends up in screenshots, tickets and chat messages. This tool shows only the first and last few characters of each value, enough to recognise which key it is, and the downloadable report is masked the same way. Private keys are reported by their BEGIN line only. The full text stays in the input box on your device, and closing the page discards it.

Pattern matching cannot know whether a value is real. Documentation examples, test fixtures and placeholders often look exactly like keys. The scanner already skips obvious placeholders in settings such as password=changeme, ${DB_PASSWORD} or process.env.API_KEY. For anything else, add a line to the ignore list: plain text hides every finding whose value or line contains it, and a value written as /regular expression/ hides matches of that expression. Equally, no pattern list is complete: a secret in an unusual format can be missed, so treat a clean result as a good sign, not a guarantee.

Assume it is compromised. Revoke or rotate the key in the provider's console first, then replace it wherever it is used, and only then remove it from the file. If it was committed to a Git repository, deleting it in a new commit is not enough: it stays in the history, so rewrite the history or treat the key as public. Check the provider's logs for use you do not recognise. To prevent repeats, keep secrets in environment variables or a secrets manager and add .env files to .gitignore.

Secrets are exactly the kind of data that must not be pasted into an online service you do not control. This page sends nothing: the patterns run in a Web Worker inside your browser, there is no upload, no analytics on the text and nothing is saved in browser storage.