Paste code, logs, or a .env file. The scanner flags cloud and AI provider keys, tokens, private keys, and database URLs, then masks them so you can share the rest.
This tool runs entirely in your browser. What you enter is never sent anywhere.Your input is never sent anywhere.
DetailsPaste code or logs
0 characters
Detection types (0 matches)
Masking style
Masked output
Paste text above and the result will appear here.
NEXT STEP
Detection is pattern-based. Even with zero matches, read your text once more before you paste it.
This scanner matches known key formats and cannot catch every secret. Even when nothing is found, read your text yourself before you paste it into an AI tool.
Why Check Code for API Keys Before You Paste It Into ChatGPT or Claude
Pasting a stack trace, a config file, or a .env file into ChatGPT or Claude can carry credentials along with it: an AWS access key, an OpenAI key, a Stripe key, or a database URL with a password. Once a credential has been sent somewhere you do not control, you cannot be sure who has seen it, so check before you paste.
This scanner lists every match with its type, line number, and severity. It looks for AWS, Google, OpenAI, Anthropic, GitHub, GitLab, Stripe, Slack, and npm credentials, JWTs, Bearer tokens, private key blocks, database URLs, and values assigned to names like password or secret. One click copies a masked version of your text.
Detection is based on known formats. A result of zero matches does not prove the text is clean, so give it a final read yourself.
When to Check Code, Logs, and .env Files
Debugging with an AI assistant
Before you paste an error log, a stack trace, or an environment dump, scan it for keys and connection strings that ended up in the output.
Asking for a code review
Config files, docker-compose files, and CI settings often hold tokens. Scan them before you share them for review.
Posting a snippet publicly
Check a snippet before you put it in a GitHub issue, a blog post, or a Stack Overflow question, in case a test key is still in it.
Sharing in chat or support tickets
Run logs and curl commands through the scanner before you send them in Slack, Jira, or an email to a vendor.
How to Redact Secrets From Code in 4 Steps
- Paste the code or log you plan to share into the text box, or load the sample text to see how it works.
- Turn detection types on or off. All types are on by default.
- Review the Findings list for the type, line number, and severity of each match.
- Pick a masking style, then copy the masked text and paste it into your AI tool.
Note: Matching and masking run in your browser. The tool does not send your text to a server.
Limits of Pattern-Based Detection
- The scanner matches known formats and cannot catch every secret. Custom internal tokens and credentials with no recognizable prefix can pass.
- Zero matches does not mean the text is safe. Read it yourself before you paste it.
- If a real key has already been shared or committed, masking is not enough. Revoke it and issue a new one.
- The Show matches view and the input box display your original text. Avoid screen sharing while they are visible.
Detected Formats: Prefixes, Lengths, and Severity
What the scanner looks for in each category, and the severity it assigns.
| Type | What it matches | Severity |
|---|---|---|
| AWS access key ID | AKIA or ASIA followed by 16 uppercase letters or digits (20 characters total) | High |
| AWS secret access key | A 40-character value after aws_secret_access_key = (only the value is masked) | High |
| Google API key | AIza followed by 35 letters, digits, hyphens, or underscores | High |
| OpenAI API key | sk- followed by 20 or more letters, digits, hyphens, or underscores (includes sk-proj- keys) | High |
| Anthropic API key | sk-ant- followed by 20 or more letters, digits, hyphens, or underscores | High |
| GitHub token | ghp_, gho_, ghu_, ghs_, or ghr_ plus 36 characters, or github_pat_ followed by 22 or more | High |
| GitLab token | glpat- followed by 20 characters | High |
| Stripe key | sk_, pk_, or rk_ followed by live_ or test_ and 16 or more characters | High |
| Private key block | A -----BEGIN ... PRIVATE KEY----- line through the matching END line, or to the end of the text if the END line is missing | High |
| Database URL | postgres, postgresql, mysql, mongodb, mongodb+srv, redis, or amqp URLs that contain user:password@host | High |
| Slack token or webhook | xoxb-, xoxa-, xoxp-, xoxr-, or xoxs- tokens, and hooks.slack.com/services/ URLs | Medium |
| npm token | npm_ followed by 36 letters or digits | Medium |
| JWT | Three dot-separated segments, starting with eyJ | Medium |
| Bearer token | The word Bearer followed by a token of 20 or more characters (only the token is masked) | Medium |
| Password or secret value | A value of 8 or more characters assigned to a name containing api_key, secret, token, password, passwd, access_key, or client_secret, in quotes or on a KEY=value line (only the value is masked) | Low |
Severity is the scanner's own rough guide, not a rating from the provider. Low-severity matches are the most likely to be false positives, so review them before you mask.
Leaked Credentials: Mask, Rotate, Revoke
How to handle a key once the scanner finds one in the text you were about to share.
Scan before you paste, not after
A copied range that happens to include a credential is easy to miss, especially in long logs and config files.
Once the text is in a chat box, it has already left your machine. A quick scan before you paste costs a few seconds and catches the obvious cases.
Look at production keys first
A key tied to production data matters more than a sandbox key.
Some providers put the environment in the key itself, as Stripe does with sk_live_ and sk_test_. This scanner reports both as High, so use the prefix to decide which match to deal with first.
Masking hides a key; revoking fixes it
Masking only changes the text you copy from this page.
If the same key sits in git history, a shared chat, or a log file, anyone with access to those places can still read it. Revoke it in the provider's dashboard and issue a new one.
Handling keyword false positives
Low-severity matches come from names like password, token, or secret. A value such as a public URL or a sample string can trigger them.
Review the Low matches separately from High and Medium ones, which match provider-specific formats, and mask only the ones that are real.
Common Mistakes When Sharing Code With AI
Treating zero matches as proof the text is clean
No known pattern matched, so you paste the text as is. A custom internal token or an oddly formatted password was never in the pattern list.
💡 See the solution▼
Skipping a test key because it looks harmless
A key labeled test or dev gets pasted without a second look, but it turns out to have the same permissions as a production key.
💡 See the solution▼
Turning off the password and secret type because it is noisy
The keyword-based type produces the most false positives, so you switch it off and miss a real password in a config file.
💡 See the solution▼
Masking the paste but leaving the key in git history
The copy you send to the AI is clean, but the same key is still committed in the repository or sitting in an old chat.
💡 See the solution▼
Copying a private key without its BEGIN line
If you copy only the middle of a PEM key, there is no -----BEGIN ... PRIVATE KEY----- header for the scanner to find, so the body is not flagged.
💡 See the solution▼
FAQ: Detection, Privacy, and False Positives
Q.Does "no matches" mean my code has no secrets?
A. No. The scanner looks for known key formats and common password assignments. A custom internal token, a secret with no recognizable prefix, or an unusual way of writing a credential can pass without a match. Treat the result as a first check and read your text yourself before you paste it.
Q.Is my code or log uploaded anywhere?
A. No. Matching and masking run as JavaScript in your browser, and the tool does not send your text to our server or to any API. The Copy button writes the masked text to your clipboard and nothing else.
Q.Which keys and tokens can it detect?
A. AWS access key IDs and secret access keys, Google API keys, OpenAI and Anthropic keys, GitHub and GitLab tokens, Stripe keys, Slack tokens and webhook URLs, npm tokens, JWTs, Bearer tokens, PEM private key blocks, database URLs that include a password, and values assigned to names such as password, secret, token, or api_key. The table above lists the exact prefixes and lengths.
Q.Does the tool show the full secret on screen?
A. The Findings list shows at most the first four characters of each match, followed by asterisks. The "Show matches" view and the input box show your original text, so avoid screen sharing while they are open.
Q.Can it scan a .env file?
A. Yes. Known formats such as AWS, OpenAI, or GitHub keys are matched wherever they appear. Lines like DB_PASSWORD=value or SESSION_SECRET=value are also flagged as low severity when the value is at least 8 characters long. Values that start with $, <, or { (for example ${DB_PASSWORD} or <your-key>) are skipped.
Q.Why does it flag something that is not a secret?
A. Low-severity matches rely on names such as password, token, or secret, so a harmless value like TOKEN_URL=https://example.com/oauth/token can be flagged. Stripe test keys (sk_test_) and publishable keys (pk_) are also reported as High. Publishable keys are meant for client-side code, so they are usually less urgent than secret keys (sk_ or rk_).
Q.Is masking enough if a key was already shared?
A. No. Masking only protects the text you copy from this tool. If a real key has been committed to a repository, posted in a chat, or printed in a shared log, revoke it in the provider's dashboard and create a new one.
Q.Which masking style should I choose?
A. Block out replaces each match with 6 to 12 block characters. Label only swaps it for a tag such as [AWS key], which tells an AI assistant what kind of value was there. Keep prefix leaves the first four characters and masks the rest.
Your feedback
makes this tool better.
Tell us which features you'd like, what should be fixed, or which new tool you'd like to see. An engineer reads every submission and uses it to guide development.