What is Secret Scanner?
Secret Scanner is a free, browser-based tool that scans your source code for accidentally leaked API keys, tokens, passwords, database connection strings, and other sensitive credentials. It uses pattern matching and Shannon entropy analysis to detect secrets across 17+ common patterns, assigns severity levels (Critical, High, Medium, Low), and partially masks findings so you can share reports safely. All processing runs entirely in your browser — no code is ever uploaded.
Common Use Cases
Pre-Commit Scanning
Paste code before committing to catch accidentally hardcoded secrets, API keys, or database credentials before they reach your repository.
Code Review
Quickly audit pull requests or code snippets for leaked tokens and passwords during the review process.
Security Audit
Scan configuration files, environment templates, and source code as part of a security audit to identify exposed credentials.
Open Source Contribution
Check your code for secrets before submitting to open source projects where credentials would be publicly visible.
How to Use This Tool
- Paste your source code into the text area, or drag and drop a source file onto the upload zone
- Click the "Scan for Secrets" button to analyze the code
- Review the summary bar showing total findings broken down by severity level
- Examine each finding in the results table — matches are partially masked for safety
- Click "Copy Report" to copy a text summary of all findings to your clipboard
Related Tools
Learn More
- OWASP Secrets Management Cheat Sheet Best practices for managing application secrets
- GitHub Secret Scanning GitHub built-in secret scanning documentation