JSON Secret & PII Scanner
Before you paste an API response into a bug report, a support ticket or a chat window, run it through here. Suspicious key names and suspicious value shapes are both detected, and you can mask, label or drop the matches.
Output appears here as you type.
Runs entirely in your browser. Nothing you paste here is uploaded or stored.
Questions
Is it safe to paste a payload that contains real secrets?
That is exactly the case this tool is built for. The scan is a pure function running in your browser tab with no network access, so the secrets never leave your machine. You can confirm it by opening your network tab, or by disconnecting from the internet first - the page keeps working.
What does it detect?
Two independent signals. Key names that look sensitive (password, api_key, authorization, client_secret and similar), and value shapes that are unmistakable: JWTs, AWS access key ids, GitHub and Slack and Stripe tokens, PEM private key blocks, connection strings with inline passwords, plus emails, phone numbers and card numbers that pass a Luhn check.
Can I rely on it to catch everything?
No, and you should not treat any scanner that way. It is a heuristic that catches the common shapes. A bespoke internal token format with no distinguishing pattern, stored under an innocuous key name, will not be flagged. Review the output before you share it.