vulnbeacon_TOOLS
← All tools

Identity & secrets

Secret scanner

Review pasted code or a local text file without uploading it. Findings mask matched values and include rotation and verification guidance.

How to use Secret scannerSteps, privacy & next steps

Find credential-shaped candidates in pasted code or a local text file.

Run this check

  1. Paste a snippet or choose a local text file.
  2. Run the local analysis and inspect the referenced lines in your original file.
  3. Confirm ownership and whether a candidate is private before rotating it and reviewing exposure.

What you need

  • Code, environment variables or configuration text. A local text file can be selected instead of pasting.

Your input & privacy

Content stays in your browser. Results retain line references and shortened fingerprints rather than raw matched values.

Read the result

Treat matches as unverified leads. A real exposed credential needs rotation, exposure removal and relevant access-log review.

Keep in mind

  • Patterns can miss arbitrary credentials and can flag examples or test values.
  • Public provider identifiers are not automatically private secrets. No credential validity, privileges or provider access is tested.

Your inputs, explained.

JWTs, source snippets, passwords, CSP text, files, hashes and Base64 are processed in browser memory. This toolkit does not upload or save those inputs.

Website checks send the approved URL to this service and contact the target. DNS checks disclose the domain to Cloudflare DNS over HTTPS. Email-breach checks send the full address to Have I Been Pwned when configured and explicitly requested.

Server checks are transient and rate limited. This application does not write tool input or result logs; your hosting provider and contacted services may retain network metadata under their own policies. Exports are saved only when you choose to download them.

Use tools only for assets you own or have permission to assess. Private scans and their saved reports use the separate authenticated VulnBeacon application.