ZeroData Tools
Tools
JSON to CSV Custom Map nested JSON arrays into clean CSV files by visually selecting the exact columns you want. JSON Formatter Format and validate JSON instantly with no uploads, no server calls, and no stored data. JSON Validator Validate JSON instantly before deploys with local processing and zero server calls. YAML Validator Validate YAML files and catch indentation errors instantly with no uploads or backend processing. Base64 Encoder Encode or decode Base64 strings instantly with zero uploads. URL Encoder Encode and decode query parameters locally for APIs, redirects, and forms. HTML Formatter Pretty-print messy markup and inspect structure without exposing page code. CSS Minifier Shrink stylesheets for production with browser-only processing and instant output.

Secret Scanner

Scan code and config files for leaked API keys, tokens, and secrets — entirely in your browser with zero uploads.

Secret Scanner
Scan code for leaked API keys and tokens. Everything stays in your browser.
Ctrl+Enter Scan30+ patterns
Code / Config InputPaste code to scan
Scan ResultsFindings
ReadyBrowser only
Paste code or configuration and click Scan to detect leaked secrets.

How ZeroData protects your privacy

  • ✓ No Uploads: Tool input is processed in your browser and is not sent to ZeroData servers.
  • ✓ No Storage: Tool input is not saved by this website.
  • ✓ No Input Tracking: Analytics never receive the text, files, keys, or credentials you process.
  • ✓ Verifiable: Disconnect from the network after the page loads; local tool processing continues without uploading your input.

How to Use the Secret Scanner

  1. Paste your code, configuration, or environment file into the input editor.
  2. Click Scan for Secrets to run the pattern detection.
  3. Review any findings with severity levels and line numbers.
  4. Rotate any exposed credentials and update your codebase.

Common Use Cases

  • Sanitizing console logs and error traces before posting to developer forums.
  • Auditing configuration files (e.g., .env) for hardcoded credentials.
  • Checking code snippets for exposed API keys before sharing via chat apps.
  • Verifying that database connection strings exclude raw passwords.
  • Educating developers on the structural patterns of common API tokens.

Frequently Asked Questions

What types of secrets can it detect?

It detects common patterns like AWS keys, GitHub tokens, Stripe keys, Slack tokens, JWTs, and generic private keys.

Is it possible for the scanner to miss a secret?

Yes. While it uses robust pattern matching, it cannot detect custom or entirely random strings that don't follow known provider formats. Always review manually.

Are my scanned texts sent to a server for analysis?

No. The scanning process is 100% local and client-side, ensuring your potentially sensitive data remains private.

Can it scan whole files?

You can paste the contents of files directly into the text area for instant analysis.

Does it detect passwords?

It can detect common structures like URI-embedded passwords (e.g., in database strings), but cannot identify standard passwords without context.

Explore more ZeroData utilities

Related Tools

Password Strength Checker

Check how strong your password is locally — entropy analysis, time-to-crack estimate, and zero data upload.

HTTP Header Analyzer

Parse and analyze HTTP response headers for security issues. Check CSP, HSTS, and more — locally in your browser.

Log File Anonymizer

Strip IPs, emails, API keys, and other PII from server logs. Regex-based scrubbing runs entirely in your browser.

Bcrypt Hash Verifier

Verify bcrypt password hashes and generate new ones entirely in your browser. Your passwords never leave your machine.

PDF Metadata Stripper

Remove author, creation date, and software metadata from PDF files securely in your browser. Zero uploads.