RunLocalTools

Secret & API Key Scanner — Find Leaked Keys, Tokens and Passwords Offline

Scan text, files, folders, zips and git diffs for leaked API keys, tokens, passwords and private keys. 135 provider rules, runs entirely in your browser, nothing uploaded.

What it does

Paste text or drop in files, a whole folder, a .zip or a git diff, and the scanner lists every leaked credential it can find: cloud keys, source-host tokens, payment keys, AI-provider keys, private keys, database passwords and generic password= assignments. Each finding gets a severity, a confidence level, a line and column, and a masked preview. You can then redact the secrets and download a clean copy, or export a report as JSON, CSV, Markdown or SARIF.

How it works

Detection runs in several passes, in a background Web Worker so the page stays responsive:

  • 135 provider rules. Each rule matches a documented key shape, such as the AKIA… prefix for AWS, ghp_… for GitHub, sk_live_… for Stripe or -----BEGIN … PRIVATE KEY----- blocks.
  • Keyword and entropy detectors. Assignments like api_password: "…" are checked for length, character mix and Shannon entropy. An optional high-entropy detector catches random-looking strings that match no known provider.
  • Decode and rescan. Base64, percent-encoded and \uXXXX-escaped text is decoded up to two layers deep and scanned again, so a key hidden inside an encoded value is still found.
  • Offline validation. A JWT is decoded to show its algorithm and expiry, an AWS key ID reveals its key type and account ID, a Stripe key shows live or test mode, and a PEM key shows whether it is passphrase-protected. None of this contacts the provider.
  • False-positive filtering. Values like changeme, ${DB_PASSWORD}, process.env.TOKEN, repeated characters and the well-known AWS and Stripe documentation keys are suppressed or downgraded. Suppressed items can be inspected.

Pattern matching can’t prove a string is a live credential, and it can miss secrets in unusual formats. A clean result is not a guarantee.

How to use it

  1. Paste text into the box, or add files, a folder or a .zip. A git diff is detected automatically and only added lines are scanned.
  2. Pick a sensitivity: Strict (provider rules only), Balanced (adds keyword rules and decoding) or Paranoid (adds entropy detection and lower thresholds).
  3. Open a finding to see its context, its badges and what to do about it. Reveal shows the real value; by default everything is masked.
  4. Mark false positives with Ignore, or use Baseline current so only new findings appear on later scans.
  5. Choose a redaction style and use Download cleaned file(s), or export a report.
  6. If a secret was real, rotate it first, then remove it from your code and git history.

Supported formats

  • Text-like files of any kind: .env, JSON, YAML, TOML, .tf, source code, shell scripts, config files, logs, .har, .ipynb, SQL and more. UTF-8 and UTF-16 are detected.
  • Folders and .zip archives (with an editable ignore list).
  • Unified git diffs.
  • Report formats: JSON, CSV, Markdown and SARIF 2.1.0, the format GitHub code scanning reads.

Limitations

  • Binary files are skipped, and the tool tells you which ones.
  • Files over 100 MB are skipped, and zip archives are capped at 5,000 files and 300 MB expanded.
  • Results stop at 5,000 findings per scan.
  • It can’t check whether a key is still active. That would mean sending the key to a third party, so the tool deliberately doesn’t do it.

Remediation

Each finding includes steps for that kind of secret: revoke or rotate it at the issuer, replace it with an environment variable or secret manager, and review the provider’s logs. If it was committed, rewrite git history after rotating. Add your secret files to a .gitignore so they stay out of the next commit, and check config files with the .env validator.

When you need to share a log or paste for support, redact it here, or strip IPs and user data from the whole file with the log anonymizer. If the scanner flags a token that looks like eyJ…, the JWT decoder shows what is inside it.

FAQ

Does my code or text get uploaded anywhere?

No. Scanning, redaction and exports all run in your browser. The only network activity by default is downloading the small zip library from a public CDN the first time you add a .zip, and that request carries none of your data.

Why was my real key not detected, or a fake one flagged?

Detection is pattern-based. A key in an unusual format can slip past, and a random-looking test value can match a rule. Switch to Paranoid to catch more, use Ignore on false positives, or add a custom rule with your own regex.

I found a secret in my repository. What should I do first?

Rotate it at the issuer immediately, because anyone who cloned the repo already has it. Then remove it from the code, purge it from git history, and check the provider’s logs for use of the old credential.

Does it remember my files after I refresh?

Only if you allow it. By default, pasted text and added files are kept in your browser’s IndexedDB for 24 hours so a refresh doesn’t lose your work, then deleted automatically. You can change this to 1 hour, until you clear it, or off. Findings themselves are never stored, and Clear everything now deletes all saved copies at once.

What is “Ignore” storing? Is my secret saved?

Ignored findings and baselines store only a one-way SHA-256 fingerprint, never the secret. You can also add pragma: allowlist secret, gitleaks:allow or nosecret to a line to skip it.

Can I add my own detection rules?

Yes. Give a rule a name, a regex and a severity, test it against sample text, and import or export rule sets as JSON. Risky patterns that could hang the browser are flagged, and any rule that runs too long is stopped.

Privacy

Local (always): scanning, decoding, validation, redaction, reports and the source viewer run entirely in your browser. Reveal state is never saved.

Saved in your browser (your choice): pasted text and added files are stored in IndexedDB so a refresh restores them. The default is 24 hours with automatic deletion; you can pick 1 hour, until you clear it, or off. Settings, custom rules and ignore fingerprints are stored in localStorage.

Optional, uses the internet (off by default): an opt-in checkbox, “Check found passwords against known breaches”, queries the Pwned Passwords range service. This step is not local-only: it needs the internet. Only the first 5 characters of each password’s SHA-1 hash are sent, never the password. Nothing else leaves your browser, and the request code can’t run unless you tick the box.

Library download: the first time you add a .zip, a small zip library is fetched from jsDelivr. No data of yours is sent.