Data Leak Self-Check & Secret Scanner
Scan logs, source code, and configuration files for exposed API keys, private credentials, AWS access keys, and sensitive PII.
Selecting a file allows the browser to read it locally. Files are processed locally in your browser when using supported tools. No upload required for supported workflows.
Drag & drop files to begin
Select or drag multiple files from your device. Entirely processed locally in your browser memory.
In-Browser Data Loss Prevention (DLP) and Secret Scanning
The Data Leak Self-Check Tool performs comprehensive Data Loss Prevention (DLP) pattern inspection across text, application logs, configuration files, and source code snippets directly within your web browser. By executing deterministic regular expression rules and Shannon entropy calculations in local client memory, developers and security engineers can audit sensitive files without risking credential exposure to third-party cloud scanners.
The scanner inspects input across 25+ categories of sensitive assets, including AWS Access Key IDs and secret keys, Google Cloud API keys, Azure connection strings, GitHub Personal Access Tokens (classic and fine-grained), GitLab tokens, NPM auth tokens, Stripe secret keys, Slack/Discord bot tokens, SendGrid API keys, and unencrypted RSA/OpenSSH/PGP private keys.
In addition to developer credentials, the tool identifies exposed PII and financial records, including Credit Card numbers (validated via the Luhn checksum algorithm), US Social Security Numbers (SSNs), phone numbers, and email addresses. Discovered leaks are mapped to exact line/column coordinates and can be redacted with a single click.
Core Tool Capabilities
- Multi-Cloud and SaaS Secret Detection: Detects AWS, Google Cloud, Azure, GitHub, GitLab, Stripe, Slack, Discord, SendGrid, and NPM authentication tokens and access keys.
- Cryptographic Key and Auth Token Inspection: Identifies unencrypted RSA, OpenSSH, and PGP private key blocks, JSON Web Tokens (JWTs), and inline Basic Auth URL credentials.
- Luhn-Validated Financial & PII Scanning: Scans for credit card numbers with mathematical Luhn checksum validation alongside US Social Security Numbers, phone numbers, and emails.
- Shannon Entropy Heuristic Detection: Calculates character randomness entropy to detect unformatted high-entropy secret keys, hex hashes, and database passwords.
- Automated Redaction and Sanitization: Generates sanitized, masked output replacing detected secrets with structured redaction placeholders ready for safe sharing.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Pre-Commit Code and Config Auditing
- • Log File Sanitization Before Support Sharing
- • Incident Response and Triage
- • Compliance and Privacy Audits
Technical Specifications & Platform Limits
Comprehensive regex patterns and validation routines.
Verifies credit card primary account numbers (PAN) mathematical validity.
Identifies high-randomness secret strings.
Zero network transmission of scanned text or keys.
Step-by-Step Workflow
Paste Text, Logs, or Source Code
Paste error logs, environment files (.env), code snippets, or configuration files into the input sandbox.
Review Overall Leak Posture
Inspect the summary dashboard for total findings count, severity breakdown (Critical, High, Medium, Low), and category distribution.
Filter and Navigate Findings
Filter findings by category (Cloud Keys, Dev Tokens, Private Keys, PII) and view exact line and column numbers for each match.
Copy Sanitized Output
Click 'Copy Sanitized Text' to obtain a redacted version of your input with all discovered secrets safely masked.
Practical Real-World Use Cases
Pre-Commit Code and Config Auditing
Software engineers checking configuration files (.env, yaml, json) for hardcoded API keys and credentials before committing to public repositories.
Log File Sanitization Before Support Sharing
DevOps and support engineers redacting authentication tokens and customer PII from server logs before sharing with external vendors.
Incident Response and Triage
Security teams assessing the scope of credential exposure in leaked snippets to rapidly identify affected service accounts and rotate keys.
Compliance and Privacy Audits
Privacy officers scanning customer support transcripts and exports for unmasked credit cards or social security numbers.
Frequently Asked Questions
- Are my sensitive keys or logs transmitted across the internet?
- No. All regular expression matching, Luhn checksum validation, and entropy calculations execute entirely within your browser using JavaScript. No logs or credentials are sent over the network.
- How does the scanner avoid false positives on credit card numbers?
- The tool pairs regex pattern matching with the mathematical Luhn algorithm (MOD 10 checksum). Pure random sequences of 16 digits that do not pass Luhn verification are filtered out to prevent false alarms.
- What is Shannon entropy detection?
- Shannon entropy measures the randomness of characters within a string. Cryptographic keys and randomly generated passwords exhibit high entropy (typically above 4.5 bits per character), enabling the scanner to flag unformatted secrets even without a known vendor prefix.
- What should I do if a Critical secret is detected?
- If a valid AWS key, GitHub PAT, Stripe secret, or private key is found in logs or code, treat the credential as compromised. Immediately deactivate and rotate the key in your provider console and review access logs for unauthorized activity.
- How does the redaction feature work?
- The redaction engine maps each detected secret back to its exact offset in the text and replaces it with a standardized tag (such as [REDACTED_AWS_ACCESS_KEY_ID]), producing a safe output that maintains formatting.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind Data Leak Self-Check & Secret Scanner - Scan for Leaked API Keys & PII with our deep-dive educational content.