Code Secret Scanner
Detect leaked API keys, passwords, tokens, private keys, and connection strings in your code. Paste any code snippet and scan for potential secrets using regex pattern matching. Everything runs in your browser — your code is never sent anywhere.
How the Code Secret Scanner Works
This tool scans your code using a collection of regular expression patterns designed to detect common types of leaked credentials. It checks for API keys from major providers like AWS, OpenAI, GitHub, and Google. It detects hardcoded passwords, database connection strings, private keys, JWT tokens, and generic secret patterns. Each finding is classified by severity and includes specific remediation recommendations.
Detection Categories
Critical: Private keys, database connection strings
High: Provider API keys (AWS, OpenAI, GitHub, Google)
Medium: Hardcoded passwords, tokens, secrets
Low: Generic key/secret/token variable assignments
The scanner uses pattern matching — it may produce false positives for example code or test data. Always review findings in context before taking action.
Why Secret Scanning Matters
Leaked credentials in source code are one of the most common security vulnerabilities. Research shows that millions of secrets are leaked on GitHub alone every year. A single exposed API key can lead to unauthorized access, data breaches, and significant financial damage. Companies like Uber, Samsung, and Toyota have all experienced major incidents caused by hardcoded credentials found in source code repositories.
Common Types of Leaked Secrets
AWS access keys (AKIA prefix) grant programmatic access to cloud infrastructure. OpenAI API keys (sk- prefix) can rack up expensive API charges. GitHub personal access tokens (ghp_ prefix) provide repository access. Database connection strings contain hostnames, usernames, and passwords in a single line. Private keys enable SSH access or decrypt sensitive communications. Each of these can cause serious damage if exposed publicly.
Best Practices for Secret Management
Never hardcode secrets in source files. Use environment variables loaded from .env files that are excluded from version control via .gitignore. For production, use dedicated secret managers like AWS Secrets Manager, HashiCorp Vault, or platform-specific secret storage. Implement pre-commit hooks that scan for secrets before code is committed. Rotate any secret that has been accidentally committed to a repository, even if the commit is later deleted — git history preserves the exposure.
What to Do When Secrets Are Found
Immediately revoke and rotate the exposed credential. Remove it from source code and replace with an environment variable reference. Check access logs for any unauthorized usage during the exposure period. Add the credential pattern to your .gitignore or pre-commit hooks to prevent future leaks. Consider using tools like git-secrets or gitleaks as part of your CI/CD pipeline for automated detection.
Frequently Asked Questions
Is my code sent to any server?
No. All scanning runs entirely in your browser using JavaScript regex pattern matching. Your code never leaves your device — it is not uploaded, stored, or transmitted to any server.
What types of secrets can this tool detect?
The scanner detects AWS access keys (AKIA prefix), OpenAI API keys (sk- prefix), GitHub tokens (ghp_ prefix), Google API keys (AIza prefix), Slack tokens, Stripe keys, database connection strings (MongoDB, PostgreSQL, MySQL, Redis), private keys, JWT tokens, and generic password/secret/token assignments.
Can this tool produce false positives?
Yes. Pattern-based scanning may flag example code, test fixtures, or placeholder values as potential secrets. Always review findings in context. A string that matches an API key pattern in test data is not necessarily a real leaked credential.
Should I use this instead of a CI/CD secret scanner?
This tool is great for quick manual checks before committing code. For automated protection, pair it with CI/CD tools like gitleaks, git-secrets, or TruffleHog that scan every commit automatically. Defense in depth is the best approach.
What should I do if a real secret is found?
Immediately revoke and rotate the credential. Remove it from source code. Check access logs for unauthorized usage. Replace it with an environment variable reference. Add the file pattern to .gitignore if applicable.
Does this detect secrets in all programming languages?
Yes. The patterns are language-agnostic because they match credential formats rather than language syntax. AWS keys, GitHub tokens, and connection strings look the same regardless of whether they appear in Python, JavaScript, Go, or any other language.
How often should I scan my code?
Scan before every commit to a repository. Also scan when onboarding new team members, during code reviews, and whenever you copy code from external sources. Automated pre-commit hooks are the most reliable approach for continuous protection.