Your files stay on your device

# Secret exposure scanner

Scans pasted code, config or text for API keys and tokens using documented vendor formats plus an entropy heuristic, splitting findings into known-format and heuristic and masking every match.

Paste something to scan it.

Known vendor formats are high confidence, not proof: a match means the string has the exact shape that vendor documents, so check it against your own code. The entropy findings are a heuristic and are labelled as one. Anything that already shipped to browsers, a bundle or a public repo, should be treated as public: rotate the credential rather than only deleting the file. Publishable keys are reported separately because they are designed to be public.
Options

## More regex & cron tools

- [Hash generator](/crypto/hash)
- [Password generator](/generate/password-generator)
- [Random token generator](/generate/random-token)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/client-side-secret-exposure-checker
Markdown version: https://nutter.tools/dev/client-side-secret-exposure-checker.md
Plain-text version: https://nutter.tools/dev/client-side-secret-exposure-checker.txt
Agent index: https://nutter.tools/llms.txt