What it looks for
Over 25 kinds of secrets with known formats, including AWS, GitHub, GitLab, Slack, Stripe, Google, Hugging Face, npm, PyPI, SendGrid, Twilio, Mailgun, Shopify and Telegram tokens, AI platform API keys, private key blocks, JSON Web Tokens and database URLs with passwords. It also flags values assigned to names like password, secret or api_key when they look random enough to be real.
Found a real key?
Redacting it here protects what you're about to share, but if the key was ever committed or posted, treat it as exposed: revoke or rotate it with the provider, then update your app. Removing it from the latest version of a file doesn't remove it from history.
Private by design
This page is not allowed to make network requests, so the text you paste can't be sent anywhere. Matches are shown partly masked.