Is it safe to paste my code or .env here?

Yes. The scanner runs entirely in your browser with JavaScript. Nothing you paste is uploaded, logged, or sent to any server — you can disconnect from the network and it still works. Detected secrets are also masked in the results so they aren't shown in full.

I committed an API key — what do I do?

Rotate it immediately — assume it is compromised the moment it touched a repo or log, even a private one. Then remove it from your code, move it to a secret manager or runtime-injected environment variable, and purge it from git history (the commit still contains it). Rotating first is the only step that actually stops the exposure.

What kinds of secrets does it detect?

AWS access keys, Stripe live/test keys, GitHub tokens, Google API keys, Slack tokens, OpenAI and Anthropic keys, SendGrid keys, npm tokens, PEM private keys, JWTs, database connection strings with embedded passwords, and generic password/secret/api-key assignments that hold a real value.

How do I reduce the chance of secrets leaking?

Avoid secrets in code or images, inject them at runtime from an appropriate secret store, keep .env out of version control, scope credentials, and retain configured action evidence. No control plane audits every action or guarantees a small blast radius.

● Free tool · 100% client-side · nothing uploaded

Did you leak a secret?

Paste code, a .env, or a config file and instantly find exposed secrets — AWS keys, Stripe keys, GitHub tokens, private keys, database passwords, JWTs. Everything runs on your device; nothing is sent anywhere, and matches are masked in the results.

Note:Pattern-based scan of the text you pasted. It catches the common, high-signal secret formats — treat a clean result as a good sign, not a guarantee. Matches are masked; assume any flagged secret is already compromised.

Scanner input stays client-side · results are masked · no account or email address is required

Why a leaked key is an emergency

The moment a secret touches a repo, a build log, a screenshot, or a paste — even a private one — assume it's compromised. Bots scan public GitHub for AWS and Stripe keys within seconds of a push, and a live key is enough to spin up servers on your bill or drain an account. The fix is never "delete the commit" — the commit still contains it. The fix is rotate first, then clean up.

Where secrets leak from

Almost always the same places: a .env that slipped into version control, a key hardcoded "just to test," a connection string with the password inline, or a secret baked into a Docker image via ENV/ARG where anyone who pulls the image can read it. Keep secrets out of code and images entirely — inject them at runtime.

Related free tools

UFW firewall generatorLock down your server CIDR / subnet calculatorSubnet / IP range math SSH hardening generatorLock down sshd_config chmod calculatorFile permissions, both ways

All free tools →

Related guide

Secrets management without a vault

This finds the leak. Infraveil shrinks what a leak can do.

Infraveil is a backend operations platform for configured managed services on servers you control. Managed actors can use scoped credentials and produce bounded action evidence, but unmanaged paths and raw credentials may still exist. The platform does not guarantee least privilege, complete audit coverage, or a small blast radius.

See the live demo →

Frequently asked questions

Is it safe to paste my code or .env?

Yes — it runs entirely in your browser, nothing is uploaded or logged, and matches are masked in the results. It works offline.

I committed an API key — now what?

Rotate it immediately (assume it's compromised), then move it to a secret store / runtime env var, and purge it from git history. Rotating first is the only step that actually stops the exposure.

What does it detect?

AWS, Stripe, GitHub, Google, Slack, OpenAI/Anthropic, SendGrid, npm, PEM private keys, JWTs, DB connection strings with passwords, and generic secret/password/api-key assignments with real values.

How do I stop this from happening?

Keep secrets out of code and images, inject them at runtime from an appropriate store, scope credentials, and verify which managed actions produce evidence. Review Infraveil's bounded control model →

Deploy, monitor, and recover.

Control production changes.

Tools for application teams.

Company and product information.