Free AI data tool · Privacy
Password and key scanner
Quick answer
Paste or upload a sample. Every line is checked for well-known key formats and labeled passwords. Findings are always masked, and you can download a copy with them replaced.
Your sample is processed in this browser. File contents are not uploaded.
Supported input
Any text file — CSV, JSON, JSONL, logs or config — up to 10 MiB or 25,000 lines.
How it works
Each line is matched against published token formats (AWS access key IDs, GitHub, Slack, Stripe and Google keys, JWTs, PEM private key headers), links with user:password@ and values of 8+ characters next to labels like password= or api_key:. Common placeholders such as ***** or ${VAR} are skipped. Where patterns overlap, the more specific one wins. Values are never shown in full.
Limitations
- Random-looking secrets without a known prefix or label (for example an AWS secret key on its own) are not detected.
- A found key must be rotated or revoked at the source; deleting it from the file does not undo the exposure.
Questions
- How do I find API keys or passwords in a file?
- Paste or upload it and press Scan. Known key formats and labeled passwords are listed by line, masked, and you can download a cleaned copy.
- What should I do if a real key is found?
- Revoke or rotate it with the service that issued it, then remove it from the file. Treat it as exposed even if the file never left your company.
- Is my file uploaded?
- No. The scan runs in your browser and the file contents are not sent anywhere.
- Is my file uploaded?
- No. The file is read and processed in this browser tab, and its contents are not sent to SourceX or anyone else. Closing the tab or pressing Reset clears it.
Related tools
Request data prepared for you
Prefer data that was checked for passwords and personal details before delivery? Describe what you need and we'll scope it.
Request data prepared for you