.env Secret Scanner
Paste any code, .env file, config or log and this tool scans it for exposed secrets — AWS keys, Google & Stripe keys, GitHub tokens, JWTs, private keys and generic credential assignments — before you commit or share it. Everything is scanned locally in your browser and nothing is uploaded.
Free · No sign-up · Updated August 2026
Scans for exposed API keys, tokens, private keys and credentials before you commit or paste them somewhere public. Everything is scanned in your browser — nothing is uploaded. If a real secret is found, rotate it.
🔒 This tool runs entirely in your browser. Your data is never uploaded.
Frequently asked questions
What secrets does it detect?＋
AWS keys, Google and Stripe keys, GitHub tokens, Slack/SendGrid/Twilio tokens, JWTs, private-key blocks, and generic api_key/secret/password/token assignments.
Is my code uploaded?＋
No — the scan runs entirely in your browser. If it finds a real secret, rotate it, since it may already be exposed elsewhere.
Does 'no secrets found' mean I'm safe?＋
Not guaranteed — it catches common patterns, but always review anything before making it public.