Security tool
Secret Paste Scanner
Paste text and scan locally in your browser for common key/token shapes. We never upload or store the pasted body.
How it works
Accidental secret commits and pasted logs are how keys escape into Slack, Notion, and GitHub issues. This scanner runs entirely in your browser: paste text, match common shapes (AWS keys, Stripe, GitHub, Slack, OpenAI-style keys, JWTs, private key blocks, and generic api_key assignments), and see counts. We never upload or store the pasted body - there is no API that receives it. False positives happen. Treat hits as leads: rotate credentials, scrub history, and check whether the secret already appeared on a public URL or repo. For live sites, run an AtRisk URL scan next; paste scanning cannot see what your CDN already serves. Use this before sharing debug output with contractors or dropping .env fragments into a ticket. Prefer a secrets manager and pre-commit hooks for the long term. Client-side regex only - not a secret-management platform, malware sandbox, or penetration test. If a hit looks real, rotate immediately and search repos and chat history for the same string before assuming the leak is contained.
This is a free teaser check - not a penetration test, vulnerability assessment, or compliance audit. AtRisk full scans go deeper across more detectors and unlock fix prompts on Starter.