OneTaskBy Tim King · Updated
Secret Scanner
Tokens, Private Keys and Hard-Coded Passwords in Code, Configs, Logs and Diffs
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Secret Scanner works
This secret scanner checks pasted code, config files, logs and diffs for API keys, access tokens, private keys and hard-coded passwords. Run it before you commit, post a snippet in a forum or share a log with support, so a live credential does not leak along with it.
What the secret scanner looks for
Many providers give their keys a fixed prefix and length, such as AKIA for AWS access keys, ghp_ for GitHub tokens, sk_live_ for Stripe and xoxb- for Slack. The scanner knows these formats for more than twenty services, plus private key blocks, webhook URLs, JSON Web Tokens and database URLs with a password in them. A match on one of these is very likely a real credential.
It also looks for values assigned to names like password, secret, token or api_key. Obvious placeholders such as changeme, your_api_key or ${VAR} are skipped. Long random-looking values are rated higher than short ones, since they are more likely to be real keys than sample text.
Each finding shows the line, the kind of secret and a masked copy so the full value is not shown on screen again. The scan runs in your browser. If a real secret has already been committed or shared, rotate it first, then clean it out of the history.
FAQ
Is my code sent anywhere?
No. The patterns run in JavaScript on this page and nothing is uploaded or logged. That matters here, because pasting a live key into an online scanner that does send it to a server is itself a leak.
Does no findings mean my code is safe?
No. The scanner catches known formats and obvious assignments, but a secret with no prefix in an unusual variable name can slip through. Use it as a quick check alongside a tool like gitleaks in CI.
Why is a test key flagged?
Test keys, such as Stripe keys starting sk_test_, are rated low because they cannot move real money. They still expose your account setup, so keeping them in environment variables rather than code is better.
I found a real key. What now?
Revoke it with the provider and create a new one straight away, because deleting the line does not remove it from git history or from anyone who already copied it. Then follow the git history steps.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Git Secret Removal Guide
Step-by-step commands to purge a leaked secret from git history.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.
API Key Generator
Random prefixed API keys with an optional checksum, like GitHub tokens.
JWT Decoder
Decode a JWT and read its claims and expiry.
CVE ID Validator
Check a list of CVE IDs for format errors and duplicates.