b2KIT

Secret Scanner for Code

Scan code snippets for accidentally committed secrets: API keys, tokens, passwords, and private keys.

Tested tool guide Tested browser tools Checked August 16, 2026

What Secret Scanner for Code does, with a checked example

This tool scans a block of pasted code or config text for strings that match the shape of known credential formats - AWS access keys, GitHub/GitLab/Slack tokens, Stripe keys, generic API key assignments, and PEM-style private key headers - and lists each match with its likely type and line number. It works by pattern matching, not by understanding your code, so it has no way to know whether a matched string is a live secret, a revoked one, or a documentation placeholder that merely looks like one. The most common surprise: a clean scan is not proof the file is secret-free.

Worked example

A concrete input and expected output from the current implementation.

Input

aws_key = "AKIAIOSFODNN7EXAMPLE"
github_token = "ghp_16C7e42F292c6912E7710c838347Ae178B4a"

Expected output

2 potential secrets found:
Line 1: AWS Access Key ID - AKIAIOSFODNN7EXAMPLE
Line 2: GitHub Personal Access Token (classic) - ghp_16C7e42F292c6912E7710c838347Ae178B4a

AKIAIOSFODNN7EXAMPLE matches AWS's access-key-ID pattern (AKIA followed by 16 alphanumeric characters), and the ghp_ string matches GitHub's classic personal-access-token format (ghp_ followed by 36 alphanumeric characters) - both get flagged even though the AWS value is the placeholder AWS itself uses in its documentation.

How the result is produced

1

Pattern library matching

The scanner runs the pasted text against a library of regular expressions for known secret formats: AWS access key IDs (AKIA followed by 16 characters), GitHub/GitLab/Slack/Stripe token prefixes, JWT structure, and PEM private-key headers such as -----BEGIN PRIVATE KEY-----. Each hit is reported with the provider/type it matched and the line it occurred on.

2

Runs locally in the browser

Scanning happens in your browser tab using JavaScript; the pasted snippet is never sent to a server or logged anywhere. That makes it reasonable to paste real production code, .env contents, or CI logs for a quick check, since nothing leaves the page - though you should still treat the browser's clipboard and tab history as local exposure points.

Good uses

  • Pasting a diff or full file before running git commit, to catch a hardcoded key left in during debugging.
  • Checking a snippet copied from an AI assistant, a forum answer, or a teammate's chat message before reusing it, since generated or copied examples sometimes carry a real credential along with them.
  • Sweeping a CI config, Dockerfile, or .env.example before pushing it to a public repo or pasting it into a support ticket or bug report.

Limits and checks

  • Detection is limited to known formats - a custom internal token, a bare password, or a secret built by concatenating variables produces no match, so a clean scan does not certify the code is free of secrets.
  • Matching is on shape alone, so widely-copied placeholder values, like AWS's own documentation key AKIAIOSFODNN7EXAMPLE, are flagged exactly like a real key; a hit still needs a human to judge whether it's live.
  • A match only says the text has the shape of a credential, not that it's still valid - if it was ever pushed to version control, revoking/rotating it and scrubbing history matters more than deleting the local line.

Common questions

If the scan comes back clean, is my code safe to commit?

Not guaranteed. The scanner only flags text matching known secret formats or obvious patterns; a custom API key scheme, a bare password string, or a token split across two variables can pass through unnoticed. Treat a clean result as a quick sanity check, not a substitute for a repo-wide secret-scanning tool or a manual review.

Does anything get uploaded when I paste my code in?

No - the scan runs entirely in your browser and the text is not transmitted anywhere. That said, finding a real key here only tells you it's exposed in the text you pasted; you still need to revoke it and remove it from your version-control history, since the leak isn't undone by closing the tab.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.