ZeroData Tools
Tools
JSON to CSV Custom Map nested JSON arrays into clean CSV files by visually selecting the exact columns you want. JSON Formatter Format and validate JSON instantly with no uploads, no server calls, and no stored data. JSON Validator Validate JSON instantly before deploys with local processing and zero server calls. YAML Validator Validate YAML files and catch indentation errors instantly with no uploads or backend processing. Base64 Encoder Encode or decode Base64 strings instantly with zero uploads. URL Encoder Encode and decode query parameters locally for APIs, redirects, and forms. HTML Formatter Pretty-print messy markup and inspect structure without exposing page code. CSS Minifier Shrink stylesheets for production with browser-only processing and instant output.

Secret Scanner

Scan code and config files for leaked API keys, tokens, and secrets — entirely in your browser with zero uploads.

Ready to use Runs locally in your browser
How this tool works

Check a snippet before it becomes a leaked credential

Paste code, a redacted log, or an environment-file excerpt when you are preparing a support ticket, pull request, or public example. The scanner looks for recognizable patterns such as AWS keys, GitHub tokens, Stripe keys, JWTs, private keys, and connection strings, then points to the matching line.

Pattern matching cannot prove that a value is active or catch every proprietary secret. Treat every finding as a reason to rotate and investigate, and review the input and result yourself before sharing anything. The scan runs in the browser.

Secret Scanner
Scan code for leaked API keys and tokens. Everything stays in your browser.
Ctrl+Enter Scan30+ patterns
Code / Config InputPaste code to scan
Scan ResultsFindings
ReadyBrowser only
Paste code or configuration and click Scan to detect leaked secrets.

This tool runs 100% in your browser; your data never leaves your device. Privacy details

How to Use the Secret Scanner

  1. Paste your code, configuration, or environment file into the input editor.
  2. Click Scan for Secrets to run the pattern detection.
  3. Review any findings with severity levels and line numbers.
  4. Rotate any exposed credentials and update your codebase.

Common Use Cases

  • Sanitizing console logs and error traces before posting to developer forums.
  • Auditing configuration files (e.g., .env) for hardcoded credentials.
  • Checking code snippets for exposed API keys before sharing via chat apps.
  • Verifying that database connection strings exclude raw passwords.
  • Educating developers on the structural patterns of common API tokens.

Frequently Asked Questions

What types of secrets can it detect?

It detects common patterns like AWS keys, GitHub tokens, Stripe keys, Slack tokens, JWTs, and generic private keys.

Is it possible for the scanner to miss a secret?

Yes. While it uses robust pattern matching, it cannot detect custom or entirely random strings that don't follow known provider formats. Always review manually.

Are my scanned texts sent to a server for analysis?

No. The scanning process is 100% local and client-side, ensuring your potentially sensitive data remains private.

Can it scan whole files?

You can paste the contents of files directly into the text area for instant analysis.

Does it detect passwords?

It can detect common structures like URI-embedded passwords (e.g., in database strings), but cannot identify standard passwords without context.

Explore more ZeroData utilities

Related Tools

Password Strength Checker

Check how strong your password is locally — entropy analysis, time-to-crack estimate, and zero data upload.

HTTP Header Analyzer

Parse and analyze HTTP response headers for security issues. Check CSP, HSTS, and more — locally in your browser.

Log File Anonymizer

Strip IPs, emails, API keys, and other PII from server logs. Regex-based scrubbing runs entirely in your browser.

Bcrypt Hash Verifier

Verify bcrypt password hashes and generate new ones entirely in your browser. Your passwords never leave your machine.

PDF Metadata Stripper

Remove author, creation date, and software metadata from PDF files securely in your browser. Zero uploads.