Accidentally committing a secret is one of the most common, and most expensive, security mistakes. The GigAI Secret Scanner reads code, config files,.
Accidentally committing a secret is one of the most common, and most expensive, security mistakes. The GigAI Secret Scanner reads code, config files,.env files or log snippets you paste and flags anything that looks like a credential: AWS access keys, Stripe and OpenAI keys, GitHub and Slack tokens, Google API keys, private-key blocks, JWTs, database connection strings with passwords, and hard-coded password assignments. Each finding shows a severity, the line number, a masked preview and a short fix hint, and the tool produces a fully redacted copy you can safely paste into a bug report or share with a teammate. Everything runs locally in your browser, the exact place sensitive code should stay, so nothing is ever uploaded. It's a pattern-based heuristic, not a security audit, so it can miss cleverly hidden secrets. Always review the findings yourself.
Last updated
Drop in a .env file, source code, a log snippet or any text. Scanning is instant and happens in your browser.
Each potential secret shows its type, severity, line number and a masked preview. Work through the high-severity ones first.
Move secrets to environment variables or a secrets manager, and rotate anything that was exposed: the fix hint tells you where.
Need to share the snippet? Copy the redacted version, which replaces every detected secret with a placeholder.
AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, Google, Twilio, SendGrid and npm tokens, private-key blocks, JWTs and database URLs with passwords.
Every finding is ranked high / medium / low, pinned to a line number, shown masked, and paired with a short remediation tip.
Get a version with every detected secret replaced by [REDACTED], safe to drop into a bug report, gist or chat.
The one tool where privacy is non-negotiable. Your code is scanned locally with the HTML/JS engine: nothing is uploaded or logged.
Run it over a diff, a config or a log paste before you commit, push or file a ticket, the cheapest possible place to catch an exposed key.
The redacted copy lets you hand a snippet to a colleague or paste a stack trace publicly without leaking the credentials inside it.
Unlike CLI scanners you have to set up, this is instant in any browser. Paste and read. Nothing to configure.
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums of any text or file at once, generate HMAC signatures with your own key, and verify a download against its expected hash, all in your browser, nothing uploaded.
Generate strong, crypto-secure passwords and memorable passphrases in your browser: control length, character sets, look-alikes and guaranteed classes, with a live entropy meter. Nothing is uploaded.
Decode and inspect any JSON Web Token instantly. Read the header, payload and signature, see when it was issued and expires, and optionally verify an HS256 signature. 100% in-browser. Your token never leaves your device.
Decode Base64 back to text or a file instantly: Unicode-safe, auto-detects URL-safe input, sniffs binary data and offers a download. Runs fully in your browser, nothing uploaded.
Generate scannable 1D barcodes (CODE128, EAN-13, UPC-A, CODE39, ITF-14, MSI, pharmacode and Codabar) live in your browser, with per-format validation and PNG or SVG export. Nothing is uploaded.
Encode text or any file to Base64 instantly: Unicode-safe, with a URL-safe toggle and one-click data URLs. Runs entirely in your browser, nothing uploaded.
Everything runs 100% in your browser. Your files are never uploaded to a server, never stored, and never seen by anyone but you.
Free, private and instant. Secret Scanner runs right in your browser.
