Security · nothing leaves your browser

Did you leak an API key? Check before someone else does.

Paste code, a .env file, logs or a config, or scan a whole project folder. It finds keys by their published formats, tells you where to revoke each one, and gives you a redacted copy that's safe to share in a bug report. Then build a rotation plan from your .env: the safe order for every secret, with the steps that don't break production.

●Runs entirely in your browser. Nothing you paste or open is uploaded or saved. Turn off your Wi-Fi and it still works.

Paste code, a .env file, logs or a config

Findings appear here as you paste. Detects 30+ formats, including OpenAI, Anthropic, Google, AWS, GitHub, Stripe, Supabase, database URLs and private keys.

What it can and can't do

Matches 30+ key formats (prefixes like sk-proj-, sk-ant-, AKIA, ghp_, sk_live_) plus database URLs, private keys and secret-looking assignments.
It never sends a key to any API to check whether it works. Treat every match as live until you've revoked it.
Keys with no recognisable format can slip through. A clean result isn't a guarantee.

Building an app that stores users' keys?

The OpenCode breach (October 2026) exposed provider keys that users had saved with the service. Read how to store users' API keys safely in Node and MongoDB: encryption at rest, per-user binding, and keeping keys out of logs.