Is anything I paste uploaded?
No. Detection runs on a WebAssembly engine loaded into the page, and the scan happens in your browser. What you paste is not sent to Postman or anywhere else, and it is not stored — closing the tab discards it.
Which kinds of secrets does it detect?
Common vendor credential formats: AWS access keys, Google API keys, GitHub and GitLab tokens, Stripe keys, Slack tokens and webhooks, SendGrid, Twilio, OpenAI and Anthropic keys, npm and PyPI tokens, Postman API keys, PEM private keys, JSON Web Tokens, and credentials embedded in a URL.
Will it catch every secret?
No, and it is worth being clear about that. The rules here anchor on recognisable vendor formats, which keeps false positives low but means a bare high-entropy password or an internal credential with no distinctive shape can pass unnoticed. A clean result means nothing recognised was found, not that the content is definitely safe.
Why is my JSON output formatted the same as my input?
Deliberately. The replacement is applied to the exact text you pasted, so indentation, key order and any comments survive untouched and only the secrets differ. That makes the result safe to paste straight back over the original.
What is the difference between the two output styles?
A variable reference names the credential type and stays meaningful — it is what you would commit, and Postman can resolve it from a vault or environment. A masked run is opaque and is what you want when pasting into a ticket or a chat.
How is this different from the scanner inside Postman?
Same detection engine, far narrower scope. This scans one thing you paste, on demand. Inside Postman the scanner runs on every save across your requests, environments and collections, uses a larger rule set plus any custom patterns your team adds, can move a detected secret into your vault for you, and gives team admins a dashboard of what has been found and resolved.
Do I need an account?
No. There is no signup, no session and no limit on how many times you scan.