Secret Scanner Online

Scan text, a file, a diff or a ZIP of a repo for leaked API keys, tokens, private keys and passwords with the 220+ gitleaks rules. Secrets are masked.

Result

Press “Run” to see the result.

Send text (text or a raw body) or a file: a single source file, a .gz, a unified diff (only added lines are scanned, with line numbers of the new file) or a .zip of a repository. The scanner applies the default gitleaks rule set (220+ rules: AWS, GitHub, GitLab, Stripe, Slack, Google, OpenAI and Anthropic keys, private keys, JWTs and many more), converted from Go RE2 to JavaScript and refreshed weekly, plus our own rule for passwords inside connection-string URLs (postgres://user:pass@host). As in gitleaks, each rule has keywords, an optional secret group, a Shannon entropy threshold and allowlists (placeholders like ${VAR}, changeme, example keys, node_modules, lock files, images).

Each finding gives rule_id, description, file, line / column (1-based) and end position, the masked secret and masked match, the entropy and a confidence (low for the generic key rule). entropy=true also reports long high-entropy strings that no rule matched. rules restricts the scan to some rule ids. Regexes run only on windows around keyword hits, with a total time budget, so a pathological input cannot run forever; the response flags timed_out or slow_rules if that happens.

Privacy: the content is scanned in memory and is never stored or logged, and secrets are masked in the response. Still, a key that has been pasted anywhere should be rotated. Limits: 5 million characters in total, files in a ZIP up to 2 MB each, 10,000 files.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/secret-scan" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\n","filename":".env"}'

const res = await fetch('https://apibox.io.vn/v1/secret-scan', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "text": "AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\n",
    "filename": ".env"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/secret-scan",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"text": "AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\n", "filename": ".env"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/secret-scan');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"text":"AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\\n","filename":".env"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Is my code stored?

No. The request is processed in memory, nothing is written to storage or logs, and the response only contains masked secrets.

Is this the same as running gitleaks?

It uses the same default rules, keywords, entropy thresholds and allowlists. A rule that cannot be converted from RE2 is dropped and counted in rules.dropped (none at the moment). Git history is not scanned, only the files you send.

Why is a finding marked low confidence?

The generic-api-key rule matches any key = "long random value" assignment, so it finds real secrets that have no known format but also some false positives. Provider-specific rules are marked high.