Is anything I paste uploaded?
No. Detection runs on a WebAssembly engine loaded into the page, and the scan happens in your browser. What you paste is not sent to Postman or anywhere else, and it is not stored — closing the tab discards it.
Which kinds of secrets does it detect?
Common vendor credential formats: AWS access keys, Google API keys, GitHub and GitLab tokens, Stripe keys, Slack tokens and webhooks, SendGrid, Twilio, OpenAI and Anthropic keys, npm and PyPI tokens, Postman API keys, PEM private keys, JSON Web Tokens, and credentials embedded in a URL.
Will it catch every secret?
No, and it is worth being clear about that. The rules here anchor on recognisable vendor formats, which keeps false positives low but means a bare high-entropy password or an internal credential with no distinctive shape can pass unnoticed. A clean result means nothing recognised was found, not that the content is definitely safe.
Why is my JSON output formatted the same as my input?
Deliberately. The replacement is applied to the exact text you pasted, so indentation, key order and any comments survive untouched and only the secrets differ. That makes the result safe to paste straight back over the original.
Can I paste the redacted copy straight back?
Yes. The replacement is applied to the exact text you pasted, so indentation, key order and any comments survive untouched and only the secrets differ. Note that the redacted copy is for sharing, not for running — the masks are not placeholders your tooling can resolve.
How is this different from the scanner inside Postman?
Same detection engine, far narrower scope. This scans one thing you paste, on demand. Inside Postman the scanner runs on every save across your requests, environments and collections, uses a larger rule set plus any custom patterns your team adds, can move a detected secret into your vault for you, and gives team admins a dashboard of what has been found and resolved.
How do I stop leaking credentials in the first place?
Stop handing them out. Passport by Postman gives a developer or an AI agent a vault reference rather than the real credential, and a proxy running inside your own cloud resolves it at call time. The secret never reaches a machine, so it cannot end up in a config file, a log or an agent context. Endpoints are grouped by host and requested with a reason; an admin approves, and the resulting grant can be revoked without rotating the secret or redeploying anything. Every call is attributed to the caller. It works with HashiCorp Vault, AWS Secrets Manager or Google Cloud Secret Manager.
I pasted a cURL — what do I do with it now?
Take the same command to Passport by Postman. Its importer reads a pasted cURL, groups the endpoints it finds by host, and asks you to map each secret it detects to a vault reference. From then on that endpoint is something your team requests access to rather than something you hold a key for, and the key stays in your own vault.
Can I scan more than one thing at a time?
Not on this page — it scans what you paste. For everything else on your machine there is the Passport CLI Community Edition, a free npm package: run passport lens start and it inspects the API calls your tools and AI agents actually make, reporting the credentials in each one with the values masked. It needs no account and, like this page, does all its processing locally.
Do I need an account?
No. There is no signup, no session and no limit on how many times you scan.