Secret Scanner (Find Leaked API Keys)
Find API keys, tokens and passwords in text and mask them before sharing.
Scanning happens in your browser and nothing is uploaded or saved. If a real secret was already shared somewhere, masking this copy does not help: revoke or rotate it.
Use via API
Scan text (code, config, logs, .env files) for leaked secrets such as AWS keys, GitHub and Stripe tokens, private keys, JWTs and passwords in URLs. Findings carry line, column, severity and a masked preview, never the raw secret. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/secret-scanner
curl https://pithlab.com/api/v1/tools/secret-scanner \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE\nDATABASE_URL=postgres://app:Xk9#[email protected]:5432/app\nDEBUG=false"}'About the Secret Scanner
Paste logs, .env or config files to find leaked API keys, tokens, private keys and passwords, then copy a masked copy that is safe to share. Runs in your browser.
How to use the Secret Scanner
- Paste the text you want to check, such as a log excerpt, a .env file, a config file or a stack trace.
- Read the findings table: each secret is listed with its line and column, type, severity and a masked preview.
- Untick “Show low-severity findings” to hide publishable keys and account IDs that are not secret on their own.
- Copy or download the masked text, which replaces each secret with a short preview such as AKIA****MPLE.
- Revoke or rotate any real secret you find. Masking a copy does not undo a leak that already happened.
Examples
Input
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY DATABASE_URL=postgres://app:[email protected]:5432/app DEBUG=true
Output
AWS_ACCESS_KEY_ID=AKIA****MPLE AWS_SECRET_ACCESS_KEY=****EKEY DATABASE_URL=postgres://app:****@db.internal:5432/app DEBUG=true
Frequently asked questions
Is my text sent anywhere?
No. Scanning is done by JavaScript in this page, and the text is not uploaded, logged or saved. Closing or reloading the page clears it. Even so, if a real secret has been pasted into a chat, ticket or log, assume it is exposed and rotate it.
What kinds of secrets does it detect?
AWS access key IDs and secret keys, GitHub and GitLab tokens, Slack tokens and webhooks, Stripe keys, OpenAI and Anthropic API keys, Google API keys, Twilio, SendGrid and npm tokens, Discord tokens and webhooks, PEM private keys, JWTs, bearer tokens, connection strings with passwords and generic password= or secret= assignments.
How does it avoid flagging placeholders?
Provider keys are matched by their exact prefix and length. Generic assignments such as password= are only reported when the value is at least 8 characters, mixes character types and has a Shannon entropy of at least 3 bits per character, and values like ${DB_PASSWORD}, changeme or <your-key> are ignored.
Why is a Stripe publishable key marked low severity?
Publishable keys (pk_live_ and pk_test_) are meant to appear in web pages, so finding one is usually fine. Test-mode secret keys are medium because they cannot move real money. Live secret keys are critical.
Can it miss secrets?
Yes. Pattern matching cannot catch every custom or unusual credential format, such as a short password in free text. Use it as a quick check before sharing, alongside a scanner in your repository and CI, not as a guarantee.