Your files never leave your device. All processing happens locally in your browser.
How do I scan text or files for exposed API keys, secrets and personal data?
Paste code, config or logs, or drop files, and the Data Leak Scanner flags secrets and PII in your browser — AWS / Google / GitHub / Stripe keys, private-key blocks, JWTs, high-entropy tokens, .env values and database URLs, plus emails, credit cards (Luhn-checked), SSNs, phones and IPs. Each finding shows its type, severity, line and a masked preview. Nothing is uploaded.
Detects live-credential patterns (gitleaks / trufflehog-style) and PII in one pass
Shannon-entropy check on generic token= / secret= assignments to cut false positives
Findings grouped by type + severity with line numbers and masked previews
Scan pasted text or dropped files; export a masked CSV / Markdown report
100% client-side — your code and files never leave the browser
What is
Secret / data-leak scanning
Secret scanning is the automated search of text, source code, configuration and logs for exposed sensitive data — credentials such as API keys, access tokens, private keys and passwords, and personal data (PII) such as emails, card numbers and national IDs. Scanners combine curated regular-expression signatures for known credential formats with entropy heuristics for generic high-randomness strings, and are used to catch secrets before they are committed, shared or leaked.
No. The text and files you scan are read and analysed entirely in your browser and are never uploaded, logged or stored on a server.
The Data Leak Scanner is 100% client-side. Pasted text stays in the page, and dropped files are read locally with the FileReader API; all pattern matching and entropy scoring run in your browser with no server, no upload and no CDN in the scanning path. Nothing is persisted — close the tab and it is gone. That makes it safe to check sensitive code, configs and logs; the exported report masks the secrets it finds so you can share the findings without re-exposing the values.
Cloud and service credentials (AWS, Google, GitHub, Slack, Stripe), private-key blocks, JWTs, database URLs, .env values and high-entropy tokens, plus PII like emails, credit cards, SSNs, phones and IP addresses.
It runs two families of detectors. SECRETS: provider-specific signatures such as AWS access keys (AKIA…), Google API keys (AIza…), GitHub tokens (ghp_ / github_pat_), Slack tokens (xox…), Stripe live keys (sk_live / rk_live), PEM private-key blocks (RSA / EC / OpenSSH / PGP), JSON Web Tokens, Authorization: Bearer headers, database connection strings (postgres://user:pass@…) and generic assignments (password= / api_key= / secret= / token=) gated by a Shannon-entropy check so only genuinely random values flag. PII: emails, credit-card numbers validated with the Luhn algorithm, SSN-style numbers, phone numbers and IPv4/IPv6 addresses. Each hit is labelled by rule, type and severity.
No scanner catches everything. Regex + entropy detection finds common patterns but misses novel or obfuscated secrets and can flag harmless high-entropy strings — a clean result is not a guarantee.
Signature-and-entropy scanning is a fast first line, not a proof. It will miss secrets in unusual formats, split across lines, encoded, or in binary; and it can raise false positives on hashes, UUIDs, minified code or test fixtures that look random. Treat findings as leads to review, and treat a clean scan as “nothing obvious found,” not “definitely safe.” For source control, run a dedicated scanner (gitleaks, trufflehog) in CI and enable your host’s push-protection, and always review high-severity hits by hand.
Treat it as compromised: ROTATE it immediately (revoke and reissue), then remove it from the code / history and store the new one in a secrets manager — not in the repo.
Once a secret has been exposed — committed, pasted, logged or shared — assume it is compromised, because deleting it later does not un-leak it. Revoke and reissue the credential at the provider first, then scrub it from files and version-control history (git filter-repo / BFG) and invalidate any sessions or tokens derived from it. Going forward, keep secrets out of source code entirely: use environment variables injected at deploy time, a secrets manager (Vault, AWS / GCP Secrets Manager, Doppler) and scoped, rotatable, least-privilege keys.
Detailed Explanation
📖How It Works
What the Data Leak Scanner Does
This tool scans text, source code, configuration and logs for exposed secrets and personal data, entirely in the browser. The user pastes content or drops files, and a deterministic engine flags two families of findings: CREDENTIALS/SECRETS (cloud and service keys, tokens, private keys, database URLs, .env values) and PII (emails, credit cards, national IDs, phones, IP addresses). Each finding carries a rule name, a type, a severity, the line number and a masked preview, so the leak is visible without re-exposing the raw value. Nothing is uploaded.
Scans pasted text/code/config/logs or dropped files, all locally
Two families: live-credential secrets and PII
Each hit: rule name, type, severity, line number, masked preview
Findings can be filtered and exported with secrets masked
100% client-side — code and files never leave the browser
⚙️Methodology
Signatures Plus Entropy
Detection combines two techniques used by tools like gitleaks and trufflehog. First, curated REGEX SIGNATURES match known credential shapes: AWS access keys (AKIA prefixes), Google API keys (AIza), GitHub tokens (ghp_ / gho_ / github_pat_), Slack tokens (xox…), Stripe live keys (sk_live / rk_live), PEM private-key blocks, JWTs, Authorization: Bearer headers and database connection strings. Second, GENERIC assignments (password= / api_key= / secret= / token=) are only flagged when the value clears a Shannon-ENTROPY threshold, which suppresses obvious placeholders and low-randomness values. PII detectors add validation where possible — credit-card candidates must pass the Luhn checksum — to cut false positives. Results are de-duplicated and sorted by severity.
Provider-specific regex signatures for common live credentials
Shannon-entropy gate on generic secret assignments cuts noise
Luhn validation on credit-card candidates
PEM key blocks, JWTs, bearer tokens and DB URLs detected
Findings de-duplicated and ranked by severity
🔧Technical Details
Local Processing and Reporting
Pasted text stays in the page and dropped files are read with the browser’s FileReader as text, so binary assets are skipped. Scanning is synchronous string work — no worker round-trip to a server, no network. The UI groups hits by type and severity, lets the user filter, and previews each match with the sensitive middle masked. Two outputs help remediation without leaking: a REDACT-ALL action returns a cleaned copy of the input with every match replaced, and the report EXPORT (CSV or Markdown) lists findings with the secrets masked so they can be pasted into a ticket safely. Severity is assigned by rule class — live credentials rank critical, PII high, weaker signals lower.
Files read locally via FileReader; no upload, no worker-to-server
Group + filter by type and severity; masked match previews
Redact-all produces a cleaned copy of the input
CSV / Markdown export keeps the actual secrets masked
Severity by rule class: credentials critical, PII high
⚠️Limitations
Honest Limitations
Regex-and-entropy scanning is a fast FIRST PASS, not a proof. It will miss secrets in unusual or custom formats, values split across lines, base64/obfuscated blobs, and anything inside binary files; and it can raise FALSE POSITIVES on hashes, UUIDs, minified bundles and test fixtures that merely look random. A clean scan therefore means “nothing obvious was found,” not “definitely safe,” and every high-severity hit deserves a human look. For version control, this browser tool does not replace a CI-integrated scanner (gitleaks / trufflehog) with push-protection and full-history scanning. And crucially: once a secret has been exposed anywhere, deleting it does not un-leak it — rotate it.
False positives on hashes, UUIDs, minified or test data
A clean result is not a safety guarantee — review high-severity hits
Not a replacement for CI scanners with full git-history scanning
Any exposed secret is compromised — rotate it, do not just delete
🔒Privacy & Security
Private by Design
Everything happens on your device. Pasted text is React state and dropped files are read locally with FileReader; all signature matching and entropy scoring run in the browser with no server, no upload, no CDN and no telemetry in the scanning path. Because the content never leaves your machine, it is safe to scan sensitive proprietary code, credentials, customer data and logs — exactly the material you must never paste into a cloud AI or online scanner. Nothing is persisted, so closing the tab erases it; the tool works offline once cached; and the exported report and redacted copy mask the secrets so sharing findings does not re-expose the values. The only optional network use anywhere on the site is consent-gated ads, which never see your input.
Text and files processed locally; no upload, server, CDN or telemetry
Safe for proprietary code, credentials, customer data and logs
Nothing persisted — closing the tab erases the input and findings
Exports and redacted copies keep secrets masked
Works offline once cached; only optional network use is consent-gated ads
Ways to catch exposed secrets and PII
Approach
Where it runs
Trade-off
Used here
This scanner (browser)
Fully local
Private first pass; misses novel/obfuscated secrets
Yes
gitleaks / trufflehog in CI
Your pipeline
Full git-history + push-protection; setup required
Recommended for repos
Host push-protection (GitHub)
Provider
Blocks known secret formats on push; provider-limited
Complementary
Manual review
Human
Catches context a regex cannot; slow and error-prone
Always for high-severity
Use this for a fast, private local check; pair repos with a CI scanner + push-protection, and rotate any secret that was ever exposed. Everything here runs locally in the browser. As of July 2026.
