API Key & Secret Leak Checker
Find hard-coded API keys, tokens, passwords, private keys and connection strings in code or config. Free and private: runs in your browser.
Paste code, config or logs to detect AWS, GitHub, Stripe, Razorpay, Google, Slack, OpenAI and other secrets before they get committed.
Runs entirely in your browser. Code, keys and tokens are never uploaded, logged or stored.
Use cases
- Spot-check a snippet during code review.
- Teach a team what the risky pattern looks like.
- Double-check a fix before you push it.
Frequently asked questions
I committed a key. Is deleting it enough?
No. It stays in Git history and may already be copied. Revoke and rotate the key first, then remove it from history and move it to a secret manager.
Is the API Key & Secret Leak Checker free?
Yes. It is free with no sign-up, and it runs entirely in your browser, so your input is never uploaded or stored.
Does a clean result mean my code is secure?
No. It means none of the common patterns this tool looks for were found in the snippet. Combine it with code review, dependency scanning and a full repository scan.
Related tools
Catch secrets, injection and unsafe code in every pull request with CodeInspector.