# Secret Scanner > Paste a payload, a .env file, a config blob or a cURL command. Every recognised credential is found, masked and located. Free, no account needed. Secret Scanner finds hardcoded API keys, tokens and private keys in text or JSON you paste, and gives you back a copy with each secret replaced by a placeholder — running entirely in your browser. Also: secret scanner, find api keys in code, detect hardcoded secrets, api key detector, find leaked credentials, redact api keys, scan env file for secrets, check for exposed tokens, credential scanner online. ## What it does Credentials leak by being committed, pasted into a ticket, or shared in a config file nobody re-read. This finds them before that happens. Paste a config file, an environment export, a request payload, a .env file or a log line, and every recognised credential is listed with its type and its exact location. You also get the same content back with the secrets swapped out, so you can replace what you pasted. The detection runs on a WebAssembly engine inside the page, so nothing you paste is uploaded anywhere. ## When to use it - You are about to commit a config file and want to know whether a key is still in it. - You need to paste a request payload into a bug report and want the credentials stripped first. - You inherited a .env file and want to know which of its values are real credentials. - You want to check a log excerpt for tokens before sharing it with support. - You are reviewing a pull request and want a second pair of eyes on a payload. ## What you give it | Input | Meaning | | --- | --- | | Text or JSON | Anything you can paste: a JSON payload, a config or .env file, a cURL command, a log excerpt. Valid JSON is scanned structurally so each finding reports its field path; everything else is scanned as text and reports a line and column. | | Output style | Whether each secret is replaced by a named Postman variable reference or by a plain masked run. | ## What you get back | Output | Meaning | | --- | --- | | Findings | One row per detected secret: the credential type, a masked preview, and where it sits — a field path for JSON, a line and column for text. | | Cleaned copy | Your original content with every detected secret replaced. Formatting, key order and comments are preserved exactly, because the replacement is made on the text you pasted rather than on a re-serialised copy. | | Count by type | How many of each credential type were found, most frequent first. | ## How it works - Each detection rule is a named regular expression anchored on a known credential format, so a match identifies which vendor the credential belongs to rather than just flagging a random string. - Valid JSON is walked structurally and every string leaf is tested, which is what allows a finding to report its field path. - A value that is already a Postman variable reference is not reported, so content you have already cleaned up does not come back as a finding. - The replacement name is derived from the credential type plus a short hash of the value, so the same secret always maps to the same placeholder and two different secrets never collide. - Detection runs on the same WebAssembly engine Postman uses in-product, compiled from Rust and executed inside the page. ## Key terms - **Hardcoded secret** — a credential written directly into a file or payload instead of being read from a variable or a secret store. It leaks whenever that file is shared, committed or exported. - **Redaction** — replacing a secret with a meaningless placeholder so the surrounding content can be shared. Distinct from encryption: redaction is not reversible, which is the point. - **Variable reference** — a named stand-in such as a double-brace token that Postman resolves at send time from an environment or a vault, so the real value never sits in the request itself. - **False positive** — a string that matches a credential format but is not a live credential — a documentation example, a test fixture, a random hash. Rules anchored on vendor prefixes keep these rare. - **Postman Vault** — a local, encrypted store for secrets on your own machine. Vault values are referenced by name from requests and are never synced to Postman servers. ## Questions ### Is anything I paste uploaded? No. Detection runs on a WebAssembly engine loaded into the page, and the scan happens in your browser. What you paste is not sent to Postman or anywhere else, and it is not stored — closing the tab discards it. ### Which kinds of secrets does it detect? Common vendor credential formats: AWS access keys, Google API keys, GitHub and GitLab tokens, Stripe keys, Slack tokens and webhooks, SendGrid, Twilio, OpenAI and Anthropic keys, npm and PyPI tokens, Postman API keys, PEM private keys, JSON Web Tokens, and credentials embedded in a URL. ### Will it catch every secret? No, and it is worth being clear about that. The rules here anchor on recognisable vendor formats, which keeps false positives low but means a bare high-entropy password or an internal credential with no distinctive shape can pass unnoticed. A clean result means nothing recognised was found, not that the content is definitely safe. ### Why is my JSON output formatted the same as my input? Deliberately. The replacement is applied to the exact text you pasted, so indentation, key order and any comments survive untouched and only the secrets differ. That makes the result safe to paste straight back over the original. ### What is the difference between the two output styles? A variable reference names the credential type and stays meaningful — it is what you would commit, and Postman can resolve it from a vault or environment. A masked run is opaque and is what you want when pasting into a ticket or a chat. ### How is this different from the scanner inside Postman? Same detection engine, far narrower scope. This scans one thing you paste, on demand. Inside Postman the scanner runs on every save across your requests, environments and collections, uses a larger rule set plus any custom patterns your team adds, can move a detected secret into your vault for you, and gives team admins a dashboard of what has been found and resolved. ### Do I need an account? No. There is no signup, no session and no limit on how many times you scan. ## Privacy Nothing you paste leaves your browser. Detection runs locally on a WebAssembly engine loaded into the page — there is no API call, no upload and no server-side scan. Content is held in memory only, is never written to storage, and is discarded when you close the tab. Telemetry records that the tool was used, never what was scanned. ## Links - [Use the tool](https://www.postman.com/tools/secret-scanner) — the interactive version of this page. - [Postman Tools](https://www.postman.com/tools) — every free tool in this set. - [Secret Scanner docs](https://learning.postman.com/docs/administration/secret-scanner/secret-scanner-overview/) — Postman documentation.