Cómo se usa
Paste the code or configuration you are about to share and run the scan. Matching lines are listed with the type of pattern that matched.
← Centro de herramientas
Escáner de secretos pegados
Introduce los datos necesarios, ejecuta la herramienta de forma segura y consulta al instante un resultado medible.
Utilidad local
Esta herramienta no llama a ningún servicio externo. Los datos sensibles introducidos no se conservan.
Qué comprueba esta herramienta
Common secret shapes are matched by pattern: long random strings, known key prefixes, JWT structure, private key blocks and password fields inside connection strings. Matching is pattern-based only - no key is validated or sent to any service.
Cómo leer el resultado
A match does not prove the string is a live secret, only that it looks like one. False positives are common: hashes, fixtures and long identifiers fit similar shapes. If you did publish a matched value, the correct response is to revoke and reissue it - deleting it from the text is not enough.
Ejemplos
Check an error log before sending it to support, or a configuration sample before adding it to documentation.
Casos de uso
Useful for developers, support teams and anyone sharing snippets.
Errores frecuentes
The critical mistake is reverting the commit after pushing a secret: the value remains in history and probably in clones. The second is treating an empty result as assurance - a pattern-based scanner cannot see a format it does not know.
Límites de esta herramienta
The tool sees only what you paste. It does not scan your repository, environment variables, commit history or server configuration. An empty result means "no known pattern found in this text", not "no leak".
Privacidad y tratamiento de datos
Text is discarded after the scan; only an anonymised run record is kept. Even so, the safest habit is never to paste a live production secret into any online tool.
Preguntas frecuentes
Is the key I paste stored?
No, the text is discarded after processing. Even so, we recommend never pasting a live production key into any online tool; the correct action is to revoke and reissue it.
The result was empty - am I safe?
An empty result only means no known pattern matched. Custom or short secrets may not be caught this way.
Is deleting a leaked key enough?
No. Once published, a key must be revoked and regenerated; removing it from the text or the commit does not invalidate it.