API Secret Scanner & Redactor
Scan code, config files, or logs for hardcoded API keys, tokens, and passwords — over 20 provider-specific patterns plus optional generic secret detection — and produce a redacted copy.
Input
Options
How detected secrets are rewritten in the redacted output.
Output
| Type | Count |
|---|---|
| No data yet | |
| Line | Type | Confidence | Masked Preview |
|---|---|---|---|
| No data yet | |||
Guides
What does this tool detect?
Hardcoded API keys, tokens, and credentials accidentally left in source code, .env files, config, or logs — over 20 provider-specific patterns (AWS, GitHub, GitLab, Stripe, Slack, Google, OpenAI, Anthropic, npm, SendGrid, Twilio, Mailgun, Square, Shopify, DigitalOcean, JWTs, PEM private key blocks, and connection-string credentials), plus an optional generic key=value/password:-style detector for anything not covered by a specific pattern.
How this tool works
- Paste code, configuration, or log output — or upload a file.
- Choose a redaction style:
[REDACTED_TYPE]labels (clearest for reviewing what was found), asterisks (uniform masking), or partial (keeps the first/last 4 characters, useful when you need to confirm which key was redacted without exposing it). - Toggle generic secret detection — broader but noisier, since it matches any
key/token/password-style assignment regardless of provider.
The Summary shows a count per secret type found. Findings lists each match's line number, type, confidence level, and a masked preview (never the full value). The Redacted Output is your original text with every detected secret replaced.
Confidence levels
Each pattern is tagged high, medium, or low confidence based on how distinctive its format is. Provider-specific prefixes like ghp_ (GitHub) or sk-ant- (Anthropic) are high-confidence — false positives are rare. Patterns matching more generic shapes (a Stripe publishable key, a Twilio Account SID, the generic assignment pattern) are lower confidence and worth a manual glance before trusting the redaction blindly.
Overlap handling
When multiple patterns could match the same text, the scanner keeps the match that starts earliest, then the widest match, then the one from the higher-priority (more specific) pattern — so a JWT inside a longer generic assignment isn't double-counted or redacted with two overlapping tokens.
Common uses
- Scanning a file before committing it, to catch an accidentally hardcoded key
- Sanitizing logs or config dumps before sharing them in a bug report or with support
- Auditing a codebase export for leaked credentials
- Producing a safely redacted copy of a
.envfile to include in documentation
Privacy
This tool runs entirely in your browser. Your code and secrets are never uploaded to a server — and share links are disabled for this tool specifically, since its whole purpose is handling sensitive text.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/api-secret-scanner-redactor \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"inputText": "# Example configuration (fake secrets)\nAWS_ACCES…",
"redactionStyle": "label",
"genericScan": "true"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `api-secret-scanner-redactor` tool (API Secret Scanner & Redactor) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.