Free tool · No sign-up
Secret & .env Scanner
Paste a code snippet, a config file, or a whole .env and it flags anything that looks like a live credential: AWS keys, Stripe and OpenAI keys, Supabase service_role tokens, private key blocks, database URLs with passwords in them, and generic high-entropy strings. Runs entirely in the browser, so the secret you are checking never leaves the tab.
Paste anything you are about to commit or share. It is scanned in your browser and never uploaded.
Method & assumptions
- Detection is by known key formats plus a high-entropy check on secret-named fields. It finds the common leaks, not every possible one.
- Matched values are masked before display — the tool tells you a secret is present without reprinting it in full.
- A test-mode or publishable key is flagged more gently than a live one, but still belongs in an environment variable.
- Everything runs in your browser. Nothing you paste is uploaded, logged, or stored.
Plate —Other tools
More on the bench
- 01Supabase Security AuditorPoint it at your project, find the holes.
- 02JWT DecoderPaste a token, read what is inside.
- 03Security Headers ScannerEnter a URL, grade its headers.
- 04CORS TesterSee exactly what a URL allows cross-origin.
- 05Base64 Encode / DecodeText or files, both directions.
- 06URL Encode / DecodePercent-encoding, both directions.
- 07JSON FormatterValidate, pretty-print, or minify.
- 08UUID Generatorv4 and v7, one or a thousand.
Free diagnosticsSame-day dispatchNamed techniciansDone or free
Need it built, not just checkedWe write the software
We write the software
behind tools like these
Anyone about to commit, paste into an issue, or share a config and wanting a last look first.