All tools

Secret Detector

AI / Agent

Scan code or config for leaked API keys, tokens, and credentials: OpenAI, AWS, GitHub, Stripe, and more

A pre-commit sanity check on a diff that touches config or environment files is a good habit, and this scans pasted code, `.env` files, or CI configs for known secret formats (OpenAI, AWS, GitHub, Stripe, and others) entirely client-side, which matters since you're pasting real credentials into it. It matches known formats specifically, so custom or unusual token shapes can slip through undetected, and finding a match here doesn't do anything beyond flagging the location: it won't revoke keys or scrub git history, so any real leaked credential still needs to be rotated immediately. Treat this as a quick manual check, not a replacement for dedicated CI tooling like git-secrets, gitleaks, or GitHub's push protection, which are the right layer for actual pipeline enforcement.

secretsapi-keyssecuritydetectleakcredentials

How to use Secret Detector

  • 1.Paste code or a config file before committing it to catch leaked API keys, tokens, and credentials for services like OpenAI, AWS, GitHub, and Stripe.
  • 2.Run it over a `.env` file or CI config to double-check nothing sensitive is about to get pushed to a public repo.
  • 3.Use it as a quick pre-commit sanity check when reviewing a diff that touches config or environment-related files.

Frequently asked questions

Does this run in my browser or on a server?
Scanning runs entirely client-side using known secret-format patterns — your code never leaves your browser, which matters since you're pasting sensitive credentials into it.
Will it catch every kind of secret?
No — it matches known formats for common providers (OpenAI, AWS, GitHub, Stripe, etc.), but custom or unusual token formats may slip through undetected.
Should I use this instead of a real secret-scanning tool in CI?
No — use it for quick manual checks, but rely on dedicated tools like git-secrets, gitleaks, or GitHub's push protection for actual CI/CD pipeline enforcement.
What happens if it finds a secret?
It just flags the match and location in the text — it doesn't revoke keys or scrub your git history, so you still need to rotate any real leaked credential immediately.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/detect-secrets \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"text": "API_KEY=sk_live_abc123xyz\nDATABASE_URL=postgres://user:pass@localhost/db"}'

Get an API key from your dashboard · Full API docs →

Related tools

Prompt Injection DetectorDetect prompt injection and jailbreak attempts in user-provided input before passing to an LLMAI / AgentRegex ReDoS DetectorScan a regex for catastrophic-backtracking (ReDoS) risk: nested quantifiers, overlapping alternation, and adjacent overlapping quantifiersCodeCSP Header BuilderBuild Content-Security-Policy headers with presets and validationNetwork