Keys and tokens left in text

Developers and reviewers can examine pasted text before sharing it when they suspect that a key or token may have been left behind.

Catch keys and tokens accidentally left in a body of text, helping reviewers identify sensitive elements before the content is shared.

How to use

1. Paste the text, code or configuration you want to inspect.
2. Run the analysis to look for potential keys and tokens.
3. Review the matches reported in the result.
4. Check each suspicious item before sharing the text.
5. Clear the content if you do not want it left on screen.

Example

With an excerpt containing an api_key line and an example password, the tool flags patterns that look like secrets. Review each alert to decide whether it is a real sensitive value or just a sample, then remove anything that should not circulate.

Input

api_key = AKIAIOSFODNN7EXAMPLE
password = example123

Limits and formats

• The scanner relies on patterns: it can report a false positive or miss a secret written in another way.
• A valid secret should not be pasted into an online tool if you do not control its use; remove it before sharing.
• The tool does not erase the secret from your files or history; correction remains manual.
• An alert is not proof: check the context and rotate any key that was truly exposed.

Where processing happens

The analysis runs entirely in your browser. The text you paste stays on your device and is not sent to any external service. You can inspect an excerpt before sharing it, without an account or storage.

Frequently asked questions

What should I do if the tool reports a false positive?

Open the context around the match and check whether the string really looks like a key or token. Variable names, documentation examples and test identifiers can trigger an alert. If it is a false positive, note it and continue your review.

Can I scan a full configuration file?

Yes, you can paste an excerpt or import a supported text file. For a large file, start with sensitive sections such as credentials, tokens and environment variables. Remove any real data before sharing the result.

Does the tool delete the secrets it finds?

No, it only flags them in the analysed text. You must remove the value, revoke the exposed key and fix the source file. If a secret was already published, treat it as compromised and replace it.

Tools in the same category

• chmod converter