Free tool · no account
Secret scanner
Paste a diff, a log, a config file, or a chat message before you share it, and find API keys, tokens, private keys, and passwords in it. The scan runs in your browser - the text is never uploaded.
Results appear here. Each finding shows the line and column, a masked preview, and what to do about it.
Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.
Next step
Stop secrets reaching the paste buffer
Shortspan injects secrets straight into the process that needs them and connects to servers and databases without showing anyone the credential - so there is less to paste, and every release is recorded.
What it looks for
Credentials with a published, recognisable format: AWS access keys, GitHub and GitLab tokens, Stripe, OpenAI, Anthropic, Google, Slack, SendGrid, npm, PyPI, DigitalOcean, Shopify, HashiCorp Vault, and Telegram tokens, Azure storage keys, private keys, JSON Web Tokens, and database connection strings that contain a password.
It also flags values assigned to names like password, secret, token, or api_key. Those are marked as possible secrets, because a pattern cannot tell a real password from a test value.
What it cannot tell you
Pattern matching finds credentials that look like credentials. It does not check whether a token is still valid, and it will miss a secret with no recognisable shape - a random password assigned to a variable called x. A clean result means nothing recognisable was found, not that the text is safe.
For repositories, run a scanner in CI and as a pre-commit hook as well; gitleaks and trufflehog are widely used open source options.
If it finds something
Treat a leaked credential as compromised, even if you deleted the message or rewrote the commit: copies outlive deletions. Revoke it at the provider, issue a replacement, and check the provider’s logs for use you do not recognise. Each finding includes where to do that.
Common questions
- Is my text uploaded anywhere?
- No. The scan is a set of regular expressions running in your browser. The page makes no network request with what you paste and does not save it.
- Does it check whether a key is still active?
- No. Checking validity would mean sending the key to the provider, which this page never does. Assume any real credential it finds is live.
- Why is the secret masked in the results?
- So the results are safe to screenshot or share. Each finding shows enough of the value to recognise it, with its line and column.
- Can I scan a whole repository with this?
- It is built for snippets you are about to share. For a repository, including its history, use a command-line scanner such as gitleaks or trufflehog.
More free tools