Secret Pattern Detector

Scans pasted text for the shape of common credential formats — AWS access keys, GitHub tokens, Stripe keys, Slack tokens, PEM private key headers, JWTs and a handful of other provider-specific patterns — before they ship in a commit, a log line, or a support ticket.

Pattern matching, not validation

This cannot tell a live key from a revoked, rotated, or entirely fabricated one — it flags text that looks like a real secret. Every match needs a human decision; the tool only narrows down where to look. A secret that does not match a known provider format will not be flagged.

Nothing here is transmitted

The scan runs entirely in this browser tab. Matches are shown redacted — only the first and last four characters — so a screenshot of the results does not itself become a way the secret leaks.

If a scan finds a real match, treat the credential as compromised, not just exposed: rotate it at the provider immediately, and if it reached a git history, remove it from every ref with a history-rewriting tool — a leaked key sitting unrotated in history is still live regardless of whether the branch is public.