What patterns does it detect?

50+ known patterns: AWS access keys, GitHub tokens, Slack webhooks, Stripe keys, private keys, JWTs, OpenAI keys, etc. Uses the same regex set as trufflehog.

Common. Test credit card numbers, example API keys in docs, or UUIDs that match an ID pattern. The tool notes confidence levels; verify before panicking.

Should I use this in CI?

For quick pre-commit checks yes. For CI, use trufflehog, gitleaks, or similar — they integrate better and maintain pattern lists.

Does it scan image files?

No — text only. For image-embedded secrets (screenshots of keys), OCR first, then scan the extracted text.

Secrets Scanner | DevTools Surf

DevTools Surf

Example: Secrets Scanner

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

const aws_key = "AKIA1234567890ABCDEF";
const db_url = "postgres://admin:password123@db.example.com:5432/prod";
const stripe_key = "sk_live_abc123def456ghi789jkl012";
const github_token = "ghp_abc123def456ghi789jkl012mnop";
const slack_webhook = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX";
const jwt_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
const apikey = "api_key=1234567890abcdef1234567890abcdef";

Output

Scanned 7 lines.
Found 8 potential secret(s):

  Line 1: [AWS Access Key] AKIA1234...CDEF (CRITICAL)
  Line 5: [AWS Secret Key] com/serv...XXXX (CRITICAL)
  Line 6: [AWS Secret Key] eyJzdWIi...Ikpv (CRITICAL)
  Line 5: [Slack Webhook] hooks.sl...XXXX (HIGH)
  Line 3: [Stripe Key] sk_live_...l012 (HIGH)
  Line 6: [JWT Token] eyJhbGci...sw5c (HIGH)
  Line 7: [Generic API Key] api_key=...def" (MEDIUM)
  Line 2: [Password in URL] ://admin...123@ (HIGH)

Review each finding — some may be false positives.

About Secrets Scanner

Secrets Scanner preview - Security / Crypto tool

Scan text/code for leaked API keys, tokens, and credentials. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Pre-commit check for accidentally pasted API keys
Audit a log file before sharing publicly
Scrub env files before committing to version control
Scan dependency READMEs before merging third-party code

Tips

Paste entire files — it scans line by line
Detects AWS keys, GitHub tokens, Stripe keys, JWTs, and more
Results show severity and line numbers

Fun Facts

GitHub scans over 200 million commits per year for leaked secrets. In 2023, they detected over 100 million leaked credentials in public repositories.
The average cost of a leaked credential that gets exploited is $4.45 million according to IBM's 2023 Cost of a Data Breach report.
AWS access keys are the most commonly leaked secret type on GitHub, followed by Google API keys and Slack webhooks.

FAQ

What patterns does it detect?: 50+ known patterns: AWS access keys, GitHub tokens, Slack webhooks, Stripe keys, private keys, JWTs, OpenAI keys, etc. Uses the same regex set as trufflehog.
False positives?: Common. Test credit card numbers, example API keys in docs, or UUIDs that match an ID pattern. The tool notes confidence levels; verify before panicking.
Should I use this in CI?: For quick pre-commit checks yes. For CI, use trufflehog, gitleaks, or similar — they integrate better and maintain pattern lists.
Does it scan image files?: No — text only. For image-embedded secrets (screenshots of keys), OCR first, then scan the extracted text.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder