API key scanner: find leaked secrets in code before you commit

Paste a file, a diff or a config. This finds AWS keys, GitHub and GitLab tokens, Stripe live keys, OpenAI and Anthropic keys, Slack tokens, Google API keys, npm tokens, SendGrid keys and private key blocks. Runs entirely in your browser: nothing you paste is sent anywhere.

Catch this automatically on every commit

Pasting files by hand doesn't scale. KatchPath is a free, MIT-licensed git guard that runs these exact patterns on every git add and git commit, and blocks .env files and node_modules too. One POSIX shell file, no dependencies.

curl -fsSL https://katchpath.com/install.sh | sh
cd your-repo && katchpath install

Read the installer   View the source   Team Pack: GitHub Action that fails PRs with keys ($19)

Already pushed a key?

  1. Rotate it first. Deleting the commit doesn't help; bots scrape public pushes within minutes. See what to rotate and how.
  2. Remove it from history only after rotating, and check your live site isn't serving the file with the .env exposure check.
  3. GitHub blocked your push? See push protection: secret detected.

What it doesn't catch

Generic passwords, database URLs and custom tokens have no fixed shape, so pattern scanners (this one, KatchPath, GitHub's) can miss them. The reliable rule: secrets live in an ignored .env, never in source.