Skip to content
TextArray1.41.0
100% local

Secret scanner

Scan text, logs or configs for AWS, GitHub, Slack and Stripe keys, private keys, JWTs and other leaked secrets.

Input
Output
Related tools
Data redactorText cleaning
HAR file sanitizernewDeveloper tools
Shannon entropy calculatorBasic tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
Secret scanner
Paste a log file, a configuration snippet or a chunk of source code and this tool scans it for strings that look like secrets — API keys, access tokens and credentials that shouldn't be shared. Each match is reported with the type of secret it resembles, so you know exactly what to rotate before you share the file with a teammate, paste it into a support ticket, or commit it by mistake.
The pattern set covers the formats vendors actually issue — AWS access keys, Google API keys, GitHub personal and fine-grained tokens, Slack tokens, Stripe keys, PEM-encoded private keys, JWTs and database connection strings with embedded credentials — and each can be turned on or off independently. A generic high-entropy detector catches anything else that looks random enough to be a secret, with its sensitivity adjustable from low to high. Turn on "Ignore sample and test values" to skip AWS's own documentation key, Stripe's sk_test_ keys and other obvious placeholders, and "Show line number and context" to see where each finding sits in the text.
Findings are reported one per line with the line number they start on, and values are masked by default so you can share the report itself without leaking anything — turn masking off if you need to see the raw match to confirm it's a real secret rather than a false positive. Switch the output to "Cleaned text" to get the original document back with every match replaced by [MASKED], ready to paste elsewhere. The scanner treats Windows and Unix line endings the same way and handles files with hundreds of thousands of lines.
Everything runs in your browser: nothing you paste is uploaded, logged or sent anywhere, which matters most for a tool whose whole job is finding things you don't want to leak. Copy the result, download it as a .txt file, or send it straight to another tool's input to keep cleaning.
FAQ
Which secret types does it recognize?
AWS access keys, Google API keys, GitHub and Slack tokens, Stripe keys, PEM private keys, JWTs, database connection strings, and any other token whose characters look random enough to trip the generic high-entropy check.
Will it flag things that aren't actually secrets?
It can, mostly from the generic high-entropy check — it's a heuristic and will occasionally flag a long random-looking ID or hash that isn't a secret at all. Lower the sensitivity, or turn that check off, if it's too noisy for your text.
What does "Ignore sample and test values" skip?
Obvious placeholders like AWS's own AKIAIOSFODNN7EXAMPLE key, Stripe's sk_test_ keys, and common wordlist markers such as "example" or "changeme" — values that are already public, not a real leak.
What is the difference between the findings list and cleaned text output?
The findings list reports each match with its line number and type, for reviewing what is in the file. Cleaned text returns the whole document with every match replaced by [MASKED], ready to paste somewhere else.
Is my text uploaded anywhere?
No. The scan runs entirely in your browser — nothing you paste is sent to a server, logged or stored.