Tools / Secret & API key scanner

Secret & API key scanner

Paste code, a config file or a JavaScript bundle — or open files — and find leaked API keys, tokens, private keys and credentials before they ship. The scan runs entirely in your browser.

Nothing is uploaded. Your code and any secret it contains are read and scanned locally in this browser tab and never sent to QCRAMAI or anyone else. Because secrets are sensitive, this tool deliberately has no network calls — reload the page and everything is gone.

Each file is capped at 5 MB and read in your browser. Minified bundles are fine.

What this scans for

It matches the formats of well-known credentials — AWS, Google/GCP, Firebase, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, OpenAI, Anthropic, npm, PyPI and more — plus private-key blocks, JSON Web Tokens, database connection strings with embedded passwords, credentials in URLs, and generic key = "…" assignments. A final pass flags high-entropy strings that look like secrets even when the provider isn't recognised.

How to read the results

Provider-format matches (e.g. an AKIA… AWS key) are high confidence. Generic assignments and high-entropy strings are lower confidence and include false positives — a long hash, a content-security nonce or a cache-busting token can look like a secret. Each finding shows its confidence so you can triage. The match is always masked; the line number points you to the original.

Limits worth knowing

This tool only sees what you give it. It cannot find a secret in a file you didn't paste, and finding none is not proof your code is clean. If a real secret is flagged, treat it as compromised the moment it reached a shared repo or a shipped bundle: rotate it first, then remove it from the source and move it to an environment variable or a secrets manager. Rotating matters more than deleting — once committed or shipped, assume it's already been harvested.