FREE TOOL · RUNS OFFLINE
API key leak checker
Paste a Jira comment, a Confluence page, a log or a .env file. The checker shows which credentials it exposes and how to revoke each one. Nothing leaves your browser: this page has no analytics and is not allowed to make network requests.
Results
Paste text and press “Check for keys”.
Share it without the keys
The same text with every key replaced, the way Secret Sentinel redacts a Jira comment. Copy it into the ticket instead of the original.
Stop checking by hand
Secret Sentinel checks every Jira issue, comment and Confluence page the moment it is saved, redacts the key in place and opens a Jira incident to rotate it. It runs on Atlassian Forge, inside your site.
What it recognises
Publicly documented formats, by their vendor-published prefixes and shapes. Each finding links the place to revoke it.
| Credential | Severity |
|---|---|
| Private key (PEM) | Critical |
| AWS access key ID | Critical |
| GitHub token | Critical |
| Stripe live secret key | Critical |
| Anthropic API key | Critical |
| OpenAI API key | Critical |
| Google API key | High |
| Slack token | High |
| Slack webhook URL | Medium |
| Atlassian API token | Critical |
| npm access token | High |
| SendGrid API key | High |
| Database URL with a password | Critical |
| GitLab personal access token | Critical |
| Azure Storage account key | Critical |
| Microsoft Entra (Azure AD) client secret | Critical |
| Google OAuth client secret | High |
| Google Cloud service account key (JSON) | Critical |
| DigitalOcean token | Critical |
| Hugging Face token | High |
| Groq API key | High |
| Replicate API token | High |
| Perplexity API key | High |
| xAI API key | High |
| Twilio API key | High |
| Mailgun API key | High |
| Shopify access token | Critical |
| Square access token | Critical |
| Docker Hub access token | High |
| PyPI upload token | High |
| HashiCorp Vault token | Critical |
| Doppler token | Critical |
| Linear API key | High |
| Notion integration token | High |
| Figma personal access token | High |
| Postman API key | High |
| Sentry auth token | High |
| New Relic user API key | High |
| Grafana token | High |
| Supabase access token | Critical |
| Mapbox secret token | Medium |
| Telegram bot token | High |
| Discord webhook URL | Medium |
| Microsoft Teams webhook URL | Medium |
| URL with a username and password | High |
| JSON Web Token | Medium |
| Password or secret in a setting | Medium |
Want to see how a scanner should behave in Jira and Confluence before you install one? See theSecret Scanner Lab and the most common types of leaked credentials.
Frequently asked questions
Is the text I paste sent anywhere?
No. The check runs in your browser. This page has no analytics, and its Content-Security-Policy (connect-src none, form-action none) forbids the browser from sending any request from it; you can confirm it in your browser’s developer tools, or disconnect from the network and the checker still works.
A key was found. What should I do?
Treat it as compromised: revoke or rotate it first (each finding says where), then delete it from the place you copied it from. Deleting the comment alone does not help; the key may already be in notifications, exports or someone’s clipboard.
Does it find every secret?
No. It recognises the publicly documented formats listed on this page. A plain password like hunter2 has no format to recognise, and a test key is not flagged. Secret Sentinel scans every Jira issue and Confluence page automatically, with more rule types and redaction.
Why check Jira and Confluence at all?
People paste credentials into tickets and wiki pages to unblock a teammate. Those pages are searchable by everyone with access, are copied into exports and emails, and are rarely covered by the secret scanning that runs on code repositories.