Heuristic scan of pasted env/config/log text for API keys, tokens, PEM keys, and JWTs.
- Free
- No signup
- Fast
- Privacy-friendly
What next?
Keep going with Secret Leak Scanner
Finish this check in the browser, then pick the path that matches how you work — another related tool, REST for apps, or MCP for agents.
- 1. Related check
After this result, run JWT decoder for the next signal.
JWT decoder - 2. Automate with API
Same job from your server with
Create free accountX-Api-Key. Free tier includes 500 credits/month. - 3. Hand off to an agent
Connect Cursor or Claude to ToolYour MCP — plan → run → verify.
MCP setup
What is Secret Leak Scanner?
Pattern scan for leaked credentials in pasted env, config, or log text. Scrub PII first with AI PII Scrubber when needed. Follow up JWT hits with JWT Decoder. Agents use secrets-and-auth-hygiene playbooks, then verify until remaining leak findings clear — see <a href="/developers/security-audit">security audit</a>.
What are common questions about Secret Leak Scanner?
What does Secret Leak Scanner do?
Heuristic scan of pasted env/config/log text for API keys, tokens, PEM keys, and JWTs.
Is this available via API and MCP?
Yes. Same route under /api/v1/security-apis/{slug} with one ToolYour API key.
What are the key features of Secret Leak Scanner?
Common secret shapes
AWS, GitHub, Slack, Stripe, Google API keys, PEM, JWTs, and secret assignments.
Redacted previews
Results show truncated matches, not full secrets.
How do you use Secret Leak Scanner?
Paste text
Drop env, config, or log snippets into the scanner.
Rotate hits
Treat high-severity matches as compromised until proven otherwise.
Free · API · MCPToolYour platform
Use Secret Leak Scanner three ways
The free Secret Leak Scanner on this page works in your browser. The same workflow is available via REST API for apps and via the remote MCP server for Cursor, Claude, and other agents — one API key, one plan, one quota. This tool is part of the security-apis module under Security Tools.
- 1Create a free accountGet an API key for REST and MCP — 500 credits/month on the free tier.
- 2Connect or callPaste the MCP URL into Cursor/Claude, or call REST with
X-Api-Key. - 3Same key & creditsBrowser smoke-checks stay free; API-backed runs share one monthly credit quota.
- Free in browserUse Secret Leak Scanner here — no account required.
- REST APICall from your server with
X-Api-Key. - Remote MCP serverSame job from Cursor or Claude via the ToolYour remote MCP server — one API key with REST.
Which secrets & auth tools sit in this cluster?
Where does this job fit on ToolYour?
Which SEO or privacy tools pair with this security check?
Where do you browse more security tools tools?
- Security Tools tools
Browse the full Security Tools category on ToolYour.
- Developer Tools tools
Format JSON, encode Base64/URL, mint UUIDs, convert timestamps, and test regex in the browser. REST and MCP sh
- Marketing Tools tools
Build UTM links, check ads copy limits, QA email subjects, and calculate ROAS/CPC/CTR — free in the browser; R
Which toolkits include Secret Leak Scanner?
- Security Toolkit
HTTP security headers, TLS, cookies, CORS, redirects, DNS, secrets, JWT, passwords, hashes, HMAC, bcrypt, security.txt, SRI, and email auth — plus agent playbooks for full audits and ship gates.
- Developer Toolkit
JSON/XML/SQL formatters, encoders, UUID/timestamp/regex, JSON codegen, JWT minting, HTTP headers, request builders, cron, minifiers, and color conversion — plus security and text peers.