FREE TOOL · RUNS OFFLINE
API key leak checker
Paste a Jira comment, a Confluence page, a log or a .env file. The checker shows which credentials it exposes and how to revoke each one. Nothing leaves your browser: this page has no analytics and is not allowed to make network requests.
Results
Paste text and press “Check for keys”.
Share it without the keys
The same text with every key replaced, the way Secret Sentinel redacts a Jira comment. Copy it into the ticket instead of the original.
Stop checking by hand
Secret Sentinel checks every Jira issue, comment and Confluence page the moment it is saved, redacts the key in place and opens a Jira incident to rotate it. It runs on Atlassian Forge, inside your site.
What it recognises
250 credential formats from 128 companies and projects. The checker runs keysnitch, our open-source engine (source on GitHub, MIT). Secret Sentinel runs on it too. It has every gitleaks rule for text, plus its own rules for passwords in settings, .env files, URLs, curl -u, Authorization headers, a table column and a sentence. Placeholders such as your_api_key or ${TOKEN} are never reported.
Companies with at least one format:
1Password, 42, Adafruit, Adobe, age, Airtable, Algolia, Alibaba Cloud, Anthropic, Asana, Atlassian, Authress, AWS, Beamer, Bittrex, Brevo, Cisco Meraki, ClickHouse, Clojars, Cloudflare, Codecov, Cohere, Coinbase, Confluent, Contentful, Databricks, Datadog, Defined Networking, DigitalOcean, Discord, Docker, Doppler, Drone CI, Dropbox, Duffel, Dynatrace, EasyPost, Etsy, Fastly, Figma, Finicity, Finnhub, Flickr, Flutterwave, Fly.io, Frame.io, Freemius, FreshBooks, GitHub, GitLab, Gitter, GoCardless, Google, Grafana, Groq, Harness, HashiCorp, Heroku, HubSpot, Hugging Face, Infracost, Intercom, JFrog, Kraken, Kubernetes, KuCoin, LaunchDarkly, Linear, LinkedIn, Lob, Mailchimp, Mailgun, Mapbox, Mattermost, MaxMind, MessageBird, Meta, Microsoft, Netlify, New Relic, Notion, npm, NuGet, Octopus Deploy, Okta, OpenAI, Perplexity, Plaid, PlanetScale, Postman, Prefect, Private AI, Pulumi, PyPI, RapidAPI, ReadMe, Red Hat, Replicate, RubyGems, Scalingo, Sendbird, Sentry, SettleMint, Shippo, Shopify, Sidekiq, Slack, Snyk, SonarSource, Sourcegraph, Square, Squarespace, Stripe, Sumo Logic, Supabase, Tailscale, Telegram, The New York Times, Travis CI, Twilio, Twilio SendGrid, Twitch, Typeform, Vercel, X, xAI, Yandex, Zendesk.
The full list with every rule is in docs/rules.md.
Want to see how a scanner should behave in Jira and Confluence before you install one? See the Secret Scanner Lab and the most common types of leaked credentials. We ran 1,400 fake leaks through this checker before and after it moved to keysnitch, and through Secret Sentinel, to see what pattern matching catches and what it misses: secret sprawl, how to detect and prevent it. Using Claude Code? See what Claude Code reads from .env and which credential it uses, tested.
Frequently asked questions
Is the text I paste sent anywhere?
No. The check runs in your browser. This page has no analytics, and its Content-Security-Policy (connect-src none, form-action none) forbids the browser from sending any request from it; you can confirm it in your browser’s developer tools, or disconnect from the network and the checker still works.
A key was found. What should I do?
Treat it as compromised: revoke or rotate it first (each finding says where), then delete it from the place you copied it from. Deleting the comment alone does not help; the key may already be in notifications, exports or someone’s clipboard.
Does it find every secret?
No. It recognises the published formats of 128 companies and projects, plus passwords written next to a word like password. A password like hunter2 with nothing around it has no format to recognise, and test keys and documentation examples are not flagged. Secret Sentinel runs the same engine on every Jira issue and Confluence page, and redacts what it finds.
Why check Jira and Confluence at all?
People paste credentials into tickets and wiki pages to unblock a teammate. Those pages are searchable by everyone with access, are copied into exports and emails, and are rarely covered by the secret scanning that runs on code repositories.