Secret Scanner (API keys and tokens)
Find API keys, tokens, private keys, password-like values and email addresses hidden in config files or logs, with line numbers and highlights. Runs entirely in your browser; nothing is saved or sent.
- Runs in your browser (no upload)
Finds API keys, tokens, private keys, email addresses and more in the pasted text. The text is processed only on this page; it is never saved or sent.
Results are never saved or uploaded. Detection is pattern-based, so it cannot find every secret and may flag harmless strings. If a real key or token shows up here, do not just delete it — revoke or rotate it with the service that issued it.
Scan results
11 possible finding(s) (severity: high 7, medium 2, low 2).
Findings
- #1HighAWS access key IDLine 2, column 19
AKIA…MPLE - #2HighAWS secret access keyLine 3, column 25
wJal…EKEY - #3HighGitHub tokenLine 4, column 14
ghp_…xxxx - #4HighSlack tokenLine 5, column 17
xoxb…xxxx - #5HighStripe live secret keyLine 6, column 19
sk_l…0000 - #6HighGoogle API keyLine 7, column 17
AIza…xxxx - #7MediumPassword or secret-like value (DB_PASSWORD)Line 8, column 14
Ex…d! - #8MediumJWT (access token)Line 9, column 23
eyJh…xxxx - #9HighPrivate key (PEM)Line 10, column 1
-----BEGIN RSA PRIVATE KEY----- … - #10LowEmail addressLine 14, column 12
ta…om - #11LowPhone numberLine 14, column 31
+8…00
Values in the list are shortened (20+ characters: first and last 4; 12–19 characters: first and last 2; shorter values are fully hidden).
Highlighted text
# Sample configuration (all values are fake)
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE#1 AWS access key ID
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY#2 AWS secret access key
GITHUB_TOKEN=ghp_EXAMPLExxxxxxxxxxxxxxxxxxxxxxxxxxxxx#3 GitHub token
SLACK_BOT_TOKEN=xoxb-000000000000-0000000000000-EXAMPLExxxxxxxxxxxxxxxxx#4 Slack token
STRIPE_SECRET_KEY=sk_live_EXAMPLE00000000000000000#5 Stripe live secret key
GOOGLE_MAPS_KEY=AIzaSyEXAMPLExxxxxxxxxxxxxxxxxxxxxxxxxx#6 Google API key
DB_PASSWORD="Ex4mple-Pa55w0rd!#7 Password or secret-like value (DB_PASSWORD)"
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzYW1wbGUtdXNlciIsIm5hbWUiOiJFeGFtcGxlIiwiaWF0IjoxNzAwMDAwMDAwfQ.EXAMPLE-signature-xxxxxxxxxxxxxxxxxxxxxxxx#8 JWT (access token)
-----BEGIN RSA PRIVATE KEY-----#9 Private key (PEM)
MIIEowIBAAKCAQEAexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexample
EXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLE00
-----END RSA PRIVATE KEY-----
# Contact: taro@example.com#10 Email address / +81 90-0000-0000#11 Phone number
How to use
- Paste the config file, log or code you want to check (a sample with fake values is filled in at first).
- Choose what to look for: keys and tokens, hard-to-guess values, and email addresses or phone numbers.
- Review the line numbers and types in the list, then copy the masked report or the text with secrets replaced if needed.
FAQ
Is the pasted text sent anywhere?
No. Scanning runs entirely in your browser; the text and results are never saved, sent or logged, and keys are never checked against any outside service.
How are "hard-to-guess values" detected?
Values of 8 or more characters assigned to keys such as secret, token, password or api_key are reported when their Shannon entropy is at least 3.0 bits per character. Variable references like ${VAR}, function calls and URLs are ignored.
What should I do if a key is found?
If it is a real key or token, deleting it from the text is not enough: it may already have been copied, shared or committed. Revoke it with the issuing service and switch to a new one.
Notes & limitations
- What you enter is processed only on this page and is not sent to YUCTS servers.
- Detection is pattern-based: keys in unknown formats or split across lines can be missed, and harmless strings can be flagged.
- The tool does not check whether a key is real or still valid (it never contacts any outside service).
- The text you enter and the results are never saved, sent or logged.
Data sources
- GitHub Docs: About authentication to GitHub — GitHub's token formats(opens in a new tab) — Checked on: 2026-10-31
- AWS IAM User Guide: IAM identifiers — unique ID prefixes (AKIA, ASIA)(opens in a new tab) — Checked on: 2026-10-31
- Slack developer docs: Tokens(opens in a new tab) — Checked on: 2026-10-31
- Stripe Docs: API keys(opens in a new tab) — Checked on: 2026-10-31
- Google Cloud: Manage API keys(opens in a new tab) — Checked on: 2026-10-31
- RFC 7468 — Textual encodings of PKIX, PKCS and CMS structures (PEM)(opens in a new tab) — Checked on: 2026-10-31
- RFC 7519 — JSON Web Token (JWT)(opens in a new tab) — Checked on: 2026-10-31
Related tools
- Secure Password Generator (cryptographic, unbiased)Create random passwords in your browser with a cryptographically secure, unbiased generator (crypto.getRandomValues). Choose length, character types and look-alike exclusion, and see the entropy.
- Password Strength Checker (guessability and crack time)Estimate how guessable a password is from its length, character types, common passwords, keyboard runs, sequences and dates, with crack-time ranges. Runs in your browser; nothing is sent or saved.
- UUID Generator and Inspector (bulk UUID v4)Generate up to 10,000 random version 4 UUIDs at once with crypto.randomUUID(), then copy them or save a TXT file. Paste any UUID to see its version, variant and embedded time.
- File Checksum Calculator (SHA-256 / SHA-512)Calculate SHA-256 and SHA-512 checksums of a file or text in your browser and check them against a published hash. Files are never uploaded.
- Text Encryption & Decryption (AES-256-GCM with a password)Encrypt and decrypt text with a password using AES-256-GCM and PBKDF2 in your browser. Random salt and nonce, tamper detection, and nothing is sent or stored.
- Personal Data Redaction for TextFind and mask email addresses, phone numbers, card numbers, Japanese My Number, Taiwan IDs, IP addresses and URLs in text. Runs entirely in your browser; nothing is sent or saved.