Find API Keys and Secrets Hidden in Text
Secrets leak in the most mundane places: pasted configs, debug logs, commit messages, and support tickets. The Token Detector scans pasted text for the recognizable patterns of common credentials — AWS access keys, GitHub personal access tokens, JWTs, and other API secrets — and flags each match with its likely provider. You need it when you are about to share a log file, clean up a repository, or check whether a snippet you received contains credentials it should not. It is a pattern scanner, not a full security audit, but it catches the leaks that cause the most damage.
How to Scan Text for Tokens
- Paste the text — a log excerpt, config file, or diff — into the input area.
- Run the scan and review each flagged match with its detected token type.
- Inspect the surrounding context to confirm whether the match is a real credential or a false positive.
- Remove or redact every confirmed secret before sharing or committing the text.
- Rotate any token that was exposed, then re-run the scan to confirm the text is clean.
Real Example: Input and Output
A developer pastes a build log before posting it in a public issue. The detector identifies embedded credentials instantly.
| Input | Output |
|---|---|
AKIAIOSFODNN7EXAMPLE | AWS Access Key ID detected |
ghp_1234567890abcdefghij | GitHub Personal Access Token detected |
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... | JWT detected |
Tips for Keeping Secrets Out of Text
- Scan before you paste — run every log, config, and diff through the detector before it reaches a ticket or chat.
- Treat every match as live — assume a leaked token is already compromised and rotate it right away.
- Use short-lived credentials — temporary tokens limit the damage window if one still slips through.
- Check the context — sample values in documentation often match token patterns, so confirm before acting.
When to Use This Tool
- Before public posts — verify that stack traces and logs shared in issues or forums contain no credentials.
- During code review — scan diffs for accidentally committed keys before a pull request merges.
- After an incident — check chat exports and support threads for secrets that may have been exposed.
Make the scan a habit rather than a reaction. Paste every log snippet, environment dump, and configuration block through the detector before it leaves your machine, and keep the result in mind when writing runbooks: the moment a secret is printed to output, it becomes a liability. Catching it in the paste buffer costs seconds; cleaning it up after a public leak costs a rotation and a postmortem.
Frequently Asked Questions
What kinds of tokens does the detector find?
It recognizes the formats of common credentials such as AWS access keys, GitHub personal access tokens, JWTs, and several other API secret patterns, and labels each match with its likely provider.
Is the Token Detector a full security audit?
No. It is a pattern scanner that flags strings shaped like known tokens. A complete audit also checks permissions, expiry, storage, and behavior — use it as a first line of defense, not a replacement.
What should I do when a token is found?
Treat it as exposed. Revoke and rotate the credential at the provider, remove it from the text and any history, then re-run the scan to confirm the text is clean.
Why does the detector flag sample keys in documentation?
Documentation examples use realistic-looking prefixes such as AKIA... by design. Review the context — a known sample value is harmless, but a real-looking key from your own system is not.
Can the detector find secrets inside a JWT?
It detects the JWT itself by its header format, so you can identify tokens in text. Use the JWT Decoder tool to inspect the header and payload, and check the signing key separately.
Does scanning text upload my data anywhere?
No. The scan runs entirely in your browser, so the pasted text never leaves your machine — which is exactly what you want when the text may contain live credentials.
How do tokens end up in logs and commits?
Applications print environment variables, CI systems inject secrets into build output, and developers commit config files by habit. Scanning is cheap, so automate it where you can.
What is the difference between detecting and preventing leaks?
Detection finds secrets that are already in text. Prevention — secret managers, environment variables, and pre-commit hooks — stops them from getting there. Use this tool for the detection half.