.env Secret Scanner
Flags lines in a .env file that look like secrets — by key name (SECRET, TOKEN, PASSWORD...), known credential formats (AWS keys, GitHub tokens...), or high entropy — before you commit or share it. Flagged values are redacted by default.
Nothing here leaves your browser. Given what this tool looks at, that matters more here than almost anywhere else on this site.
When you'd use this
- Checking a .env file for accidentally-committed secrets before pushing to a repository
- Reviewing what credentials a downloaded project's .env file actually exposes
- Auditing a config file for API keys or passwords before sharing it
This is heuristic pattern-matching, not a guarantee — it can miss real secrets that don’t match a known pattern, and can flag ordinary values that happen to look secret-shaped. Treat it as a second pair of eyes, not a certification.