Secret Scanner

It scans the text you paste for known secret formats — AWS keys, GitHub/GitLab tokens, Stripe keys, Slack tokens, private key blocks, database connection strings with embedded passwords, and similar patterns — the same category of format-matching rules tools like Gitleaks and GitHub's own secret scanning use. It doesn't walk git history or do full entropy analysis, so treat it as a fast first pass, not a replacement for a proper repository-wide audit.

No. The content is scanned in memory for this one request and never written to a database or log. Matched secrets are never returned in full either — only a masked preview (first/last 4 characters) — so even the response never carries a usable copy of a real credential.

Rotate it immediately, wherever it's used — the moment a credential has been pasted anywhere outside its intended system, treat it as compromised. Then remove it from source (use environment variables or a secrets manager), and if it was ever committed to git, scrub it from history (git filter-repo or BFG Repo-Cleaner) since rotation alone doesn't erase the old value from your repo's history.

Pattern-based detection only recognizes formats it has a rule for. A custom internal API key with no distinctive prefix, or a secret embedded in an unusual format, can slip past regex matching entirely. For full coverage across a real codebase, pair this with a proper git-history-aware scanner (Gitleaks, TruffleHog) in CI.

Yes, up to 300,000 characters (roughly a 5,000-line file). For a whole repository, scan file-by-file, or run a dedicated CI-integrated scanner that can walk every file and commit automatically.