Free tools

Find the keys hiding in a file

Paste a .env file, a config file or a diff. Every match is found and shown in this tab, and the value itself is masked so a screenshot is not a second leak.

In your browser nothing you paste is uploaded

Matches are shown with the value masked, so a screenshot of this page is not a second leak. Nothing is uploaded and nothing is stored.

Findings

    Paste something above to check it.

    This checks one thing. A scan reads your whole repository and tells you what an attacker would find first.

    Free scan
    More tools
    JWT debugger Decode a token and catch alg:none, a missing expiry, and secrets in the payload. CSP evaluator Grade a Content-Security-Policy and see which directive undoes it. SRI hash generator Generate the integrity attribute for a script or stylesheet you load from a CDN. Hash generator MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text, at once. Base64 encoder Encode and decode Base64, including URL-safe, with UTF-8 handled properly.