Sensitive Info Scanner
Scan code and configs for API keys, passwords, tokens and database URLs with risk grading and location hints
Input code or text
Supported detections
- API keys for payment and third-party services
- JWT tokens (JSON Web Token)
- Password fields like password/secret
- Database connection strings and credentials
- AWS Access Key / Secret Key
- Private keys in RSA/PEM formats
Common leak patterns
API_KEY = "sk_live_..."
password = "12345678"
const SECRET = "abc123..."
export default "eyJhbGciOi..."
mysql://user:pass@host
Security tips
- Store secrets in environment variables instead of hardcoding
- Use .env files and add them to .gitignore
- Enable git-secrets or similar scanners before commit
- Scan repositories regularly for exposed credentials
- Rotate keys or tokens immediately if leaks are found
Guide
Overview
Sensitive Info Scanner runs locally in your browser to detect secrets in code, configs, and logs, with risk levels and location hints for fast reviews.
Key features
- Covers API keys, JWTs, password fields, database URLs, AWS keys, and private keys
- Shows line and column positions for faster fixes
- Provides high/medium/low risk grading with summary counts
- Includes sample data and quick clear for review workflows
Detection scope
- Matches common cloud and third-party key patterns
- Detects database connection strings with credentials
- Identifies JWT headers and private key markers
- Flags common password field names
How to use
- Paste code, config, or logs
- Choose the detection types
- Click Start scan to view results
- Fix issues based on risk and guidance
Result interpretation
- High risk: likely real secrets; rotate immediately
- Medium risk: possible tokens or test keys; verify
- Low risk: weak matches; confirm with context
Security tips
- Move secrets to env vars or a key management system
- Use pre-commit hooks or CI scans for second checks
- Audit past commits and rotate credentials when needed
Privacy
- All scans run locally in your browser; data never leaves the device
- Clear inputs after use on shared machines