Does this replace repository secret scanning?

No. It is a fast local pre-flight check for pasted text. Keep using server-side and CI secret scanners for full repository and history coverage.

Will it upload my logs or secrets?

No. Pattern matching, entropy scoring and redaction run inside your browser with React state only.

Why does it flag high-entropy strings?

Many generated tokens look random. Entropy is a heuristic, so review the context before rotating credentials.

Crypto & Hash

Secret Scanner

A local pre-flight scanner for anything you are about to paste into chat, tickets or docs. It highlights credential-shaped strings, estimates entropy, creates a redacted copy and turns findings into a concise incident checklist without uploading the payload.

scope boundary

This is a local pre-flight scanner for text you are about to share. It is useful for paste safety, redaction and triage, but it does not replace repository history scanning, provider-side leak detection, DLP, or incident response.

untrusted-input.txt608 chars

exposure radar

100

10 signals require review

critical

high

medium

low

payment: 1cloud: 2code-hosting: 1messaging: 1key-material: 1database: 1generic: 2auth: 1

incident-notes.md

Secret pre-flight report

Findings: 10
Immediate rotation candidates: 0

Triage playbook:
1. Stop sharing the original text until redacted.
2. Confirm whether each finding is production, staging, test or fixture data.
3. Rotate critical/high credentials that crossed a trust boundary.
4. Audit access logs for the affected provider or service.
5. Replace literals with secret-manager references and purge public history.

1. [MEDIUM / strong] Stripe live secret key at 3:19
   category: payment
   value: sk_liv...9xZp
   entropy: 4.46 bits/char
   action: Roll the Stripe key immediately and review API, payout and webhook activity.
   false-positive check: Live Stripe prefixes are high signal; test keys use sk_test and still deserve care.
2. [MEDIUM / strong] AWS access key id at 5:19
   category: cloud
   value: AKIAIO...MPLE
   entropy: 3.68 bits/char
   action: Disable the IAM key, inspect CloudTrail for use, and migrate to short-lived role credentials.
   false-positive check: AWS sample keys are common in docs; check whether the surrounding account id or secret key is real.
3. [MEDIUM / strong] GitHub token at 7:1
   category: code-hosting
   value: github...cdef
   entropy: 4.84 bits/char
   action: Revoke the token, audit repository and org events, then replace it with fine-grained short-expiry credentials.
   false-positive check: GitHub token prefixes are specific; assume live unless clearly documented as a fake fixture.
4. [MEDIUM / strong] Slack webhook URL at 8:15
   category: messaging
   value: https://hook...XXXX
   entropy: 3.40 bits/char
   action: Revoke the webhook URL and check whether unexpected messages were sent to the channel.
   false-positive check: Webhook URLs are bearer credentials; treat full URLs as sensitive.
5. [MEDIUM / strong] Private key block at 9:1
   category: key-material
   value: [REDACTED_MULTILINE_SECRET]
   entropy: 4.30 bits/char
   action: Rotate the key pair, remove it from history, and replace the literal with a vault or KMS reference.
   false-positive check: Usually only safe if this is generated fixture text with no production trust path.
6. [MEDIUM / review] Database URL with password at 2:14
   category: database
   value: postgres://app:dev-password@db.internal:5432/m...ools
   entropy: 4.36 bits/char
   action: Rotate the database password, invalidate leaked connection strings, and move the value to secret storage.
   false-positive check: Local docker credentials can be low risk, but copied production hostnames make this urgent.
7. [MEDIUM / review] Sensitive variable assignment at 3:1
   category: generic
   value: STRIPE_SECRET_KEY=sk_liv...9xZp
   entropy: 4.86 bits/char
   action: Move the value out of shared text, rotate it if it left a trusted boundary, and reference a secret manager key.
   false-positive check: Placeholders like changeme, example, dummy and test are usually low risk but should not normalize bad patterns.
8. [MEDIUM / review] Bearer token at 4:16
   category: auth
   value: Bearer...ture
   entropy: 4.84 bits/char
   action: Treat bearer values as live credentials unless verified as test data or expired.
   false-positive check: Bearer is a transport wrapper; inspect the token type and surrounding environment.
9. [MEDIUM / review] Sensitive variable assignment at 6:1
   category: generic
   value: AWS_SECRET_ACCESS_KEY=wJalrX...EKEY
   entropy: 4.72 bits/char
   action: Move the value out of shared text, rotate it if it left a trusted boundary, and reference a secret manager key.
   false-positive check: Placeholders like changeme, example, dummy and test are usually low risk but should not normalize bad patterns.
10. [MEDIUM / review] AWS secret access key shape at 6:23
   category: cloud
   value: wJalrX...EKEY
   entropy: 4.66 bits/char
   action: If paired with an AWS key id or env name, rotate the IAM key and audit recent access.
   false-positive check: Any 40-character base64-like string can match; confidence depends on nearby AWS context.

mediumstrong

Stripe live secret key

Roll the Stripe key immediately and review API, payout and webhook activity.

False-positive check: Live Stripe prefixes are high signal; test keys use sk_test and still deserve care.

L3:C19 · H 4.46 · payment

sk_liv...9xZp

2: DATABASE_URL=postgres://app:dev-password@db.internal:5432/monotools
3: STRIPE_SECRET_KEY=sk_liv...9xZp
4: Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo.signature

mediumstrong

AWS access key id

Disable the IAM key, inspect CloudTrail for use, and migrate to short-lived role credentials.

False-positive check: AWS sample keys are common in docs; check whether the surrounding account id or secret key is real.

L5:C19 · H 3.68 · cloud

AKIAIO...MPLE

4: Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo.signature
5: AWS_ACCESS_KEY_ID=AKIAIO...MPLE
6: AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

mediumstrong

GitHub token

Revoke the token, audit repository and org events, then replace it with fine-grained short-expiry credentials.

False-positive check: GitHub token prefixes are specific; assume live unless clearly documented as a fake fixture.

L7:C1 · H 4.84 · code-hosting

github...cdef

6: AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
7: github...cdef
8: SLACK_WEBHOOK=https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

mediumstrong

Slack webhook URL

Revoke the webhook URL and check whether unexpected messages were sent to the channel.

False-positive check: Webhook URLs are bearer credentials; treat full URLs as sensitive.

L8:C15 · H 3.40 · messaging

https://hook...XXXX

7: github_pat_11AAABBBB_demoTokenOnly_1234567890abcdef
8: SLACK_WEBHOOK=https://hook...XXXX
9: -----BEGIN PRIVATE KEY-----

mediumstrong

Private key block

Rotate the key pair, remove it from history, and replace the literal with a vault or KMS reference.

False-positive check: Usually only safe if this is generated fixture text with no production trust path.

L9:C1 · H 4.30 · key-material

[REDACTED_MULTILINE_SECRET]

8: SLACK_WEBHOOK=https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX
9: -----BEGIN PRIVATE KEY-----
10: demo only - replace with a real scan target

mediumreview

Database URL with password

Rotate the database password, invalidate leaked connection strings, and move the value to secret storage.

False-positive check: Local docker credentials can be low risk, but copied production hostnames make this urgent.

L2:C14 · H 4.36 · database

postgres://app:dev-password@db.internal:5432/m...ools

1: # Paste logs, .env files, HTTP transcripts or config snippets here.
2: DATABASE_URL=postgres://app:dev-password@db.internal:5432/m...ools
3: STRIPE_SECRET_KEY=sk_live_51N7FakeTokenForDemoOnly9xZp

mediumreview

Sensitive variable assignment

Move the value out of shared text, rotate it if it left a trusted boundary, and reference a secret manager key.

False-positive check: Placeholders like changeme, example, dummy and test are usually low risk but should not normalize bad patterns.

L3:C1 · H 4.86 · generic

STRIPE_SECRET_KEY=sk_liv...9xZp

2: DATABASE_URL=postgres://app:dev-password@db.internal:5432/monotools
3: STRIPE_SECRET_KEY=sk_liv...9xZp
4: Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo.signature

mediumreview

Bearer token

Treat bearer values as live credentials unless verified as test data or expired.

False-positive check: Bearer is a transport wrapper; inspect the token type and surrounding environment.

L4:C16 · H 4.84 · auth

Bearer...ture

3: STRIPE_SECRET_KEY=sk_live_51N7FakeTokenForDemoOnly9xZp
4: Authorization: Bearer...ture
5: AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE

mediumreview

Sensitive variable assignment

Move the value out of shared text, rotate it if it left a trusted boundary, and reference a secret manager key.

False-positive check: Placeholders like changeme, example, dummy and test are usually low risk but should not normalize bad patterns.

L6:C1 · H 4.72 · generic

AWS_SECRET_ACCESS_KEY=wJalrX...EKEY

5: AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
6: AWS_SECRET_ACCESS_KEY=wJalrX...EKEY
7: github_pat_11AAABBBB_demoTokenOnly_1234567890abcdef

mediumreview

AWS secret access key shape

If paired with an AWS key id or env name, rotate the IAM key and audit recent access.

False-positive check: Any 40-character base64-like string can match; confidence depends on nearby AWS context.

L6:C23 · H 4.66 · cloud

wJalrX...EKEY

5: AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
6: AWS_SECRET_ACCESS_KEY=wJalrX...EKEY
7: github_pat_11AAABBBB_demoTokenOnly_1234567890abcdef

runtime

Browser-local execution

Inputs stay inside the current tab unless you copy, download or explicitly export.

memory

Session handoff

Magic Paste can pass input to a target tool through sessionStorage, never through the URL.

control

User-owned state

Favorites, recent tools and workflow history are local browser data you can clear from the browser.

smart handoff graph

Suggested next moves

session handoff ready

/web

Magic Paste

Paste anything and get routed to the right local tool with confidence signals.

/web

JWT Lab

Sign and verify HS256 JWTs locally, with decoded header and payload.

/text

.env Parser

Convert .env files to JSON or scrubbed .env.example templates.

/web

Workflow Builder

Chain JSON, JWT, Base64, URL, HTML, text and hash operations in one local recipe.

sponsor

Fixed native slots for developer products. No third-party tracking, no popups, no layout shift.

Sponsor this tool

How to use

01Paste a log, .env file, stack trace, config snippet or HTTP transcript.
02Review the exposure radar, severity groups and line/column findings.
03Copy the redacted output or incident notes before sharing the text.

FAQ

Does this replace repository secret scanning?: No. It is a fast local pre-flight check for pasted text. Keep using server-side and CI secret scanners for full repository and history coverage.
Will it upload my logs or secrets?: No. Pattern matching, entropy scoring and redaction run inside your browser with React state only.
Why does it flag high-entropy strings?: Many generated tokens look random. Entropy is a heuristic, so review the context before rotating credentials.

Stripe live secret key

AWS access key id

GitHub token

Slack webhook URL

Private key block

Database URL with password

Sensitive variable assignment

Bearer token

Sensitive variable assignment

AWS secret access key shape

Browser-local execution

Session handoff

User-owned state

Suggested next moves

How to use

FAQ

Related tools