Your files stay on your device

Secret exposure scanner

Scans pasted code, config or text for API keys and tokens using documented vendor formats plus an entropy heuristic, splitting findings into known-format and heuristic and masking every match.

Paste something to scan it.

Known vendor formats are high confidence, not proof: a match means the string has the exact shape that vendor documents, so check it against your own code. The entropy findings are a heuristic and are labelled as one. Anything that already shipped to browsers, a bundle or a public repo, should be treated as public: rotate the credential rather than only deleting the file. Publishable keys are reported separately because they are designed to be public.
Options

More regex & cron tools

- Hash generator (/crypto/hash)
- Password generator (/generate/password-generator)
- Random token generator (/generate/random-token)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/client-side-secret-exposure-checker
Markdown version: https://nutter.tools/dev/client-side-secret-exposure-checker.md
Plain-text version: https://nutter.tools/dev/client-side-secret-exposure-checker.txt
Agent index: https://nutter.tools/llms.txt