Secret & API Key Scanner
Paste a .env, config, log or code snippet and find API keys, tokens and private keys — vendor patterns plus entropy and variable-name context, values masked by default, read-only and never verified against any vendor
forge-secret-scanv1.0.0gitleaks rule corpus (github.com/gitleaks/gitleaks, MIT) — vendor-prefix patterns · Shannon entropy (C. E. Shannon, A Mathematical Theory of Communication, 1948) · RFC 7519 (JWT) · RFC 7468 (PEM textual encodings) · RFC 3986 §3.2.1 (userinfo in URIs)
Workspace
Local or server · same path as API
dev/secret-scanDrop a file to scan it
Runs entirely in your browser. Nothing is sent anywhere — not even to us.
Runs entirely in your browser. Nothing is sent anywhere — not even to us.
Paste something and press Scan.
Checks for vendor API keys, tokens, private keys and high-entropy secrets. Matched values are masked; only line numbers are shown in full.
Detection only: this tool never contacts a vendor to check whether a key is still live — that would mean sending your key to a third party.
API
forge.dev.secret_scanSame contract as the page. Use an authenticated key in production.
curl -X POST 'https://forge.nebutra.com/v1/tools/dev/secret-scan/invoke' \
-H 'Authorization: Bearer sk-sailor-…' \
-H 'Content-Type: application/json' \
-d '{
"example": true
}'