Free · 8 checks
Email Spoofing Checker
Can someone send email pretending to be you? Check your domain's SPF, DKIM and DMARC records, with a plain-English verdict, a score out of 100 and a fix for every gap.
Free tool · API Key Leak Checker
Is your website leaking API keys?
Paste your site's HTML and JavaScript, or collect it in one click, to find secret keys, tokens and passwords that any visitor could copy. It checks for more than 40 types of key, tells you which ones are meant to be public, and never sends your code anywhere.
The checker
Find exposed keys in seconds.
Everything your website sends to a browser can be read by anyone who visits. The checker reads that same code, on your device, and flags anything that should have stayed on your server.
Collect your site's code in one click
- Drag this button to your browser's bookmarks bar: Collect page code
- Open your website and click the bookmark. It copies the page and its JavaScript files.
- Come back here, paste into the box and press Check for keys.
Prefer to do it by hand? Right-click your page, choose View Page Source, and open each linked .js file. If you have the project files, upload everything in your build folder, such as dist, build or .next/static.
Your result
What the checker found
- Secret keys
- 0
- To review
- 0
- Public keys
- 0
- Scanned
- 0
Findings
Secrets first. Values are masked so this page never shows a full key.
Meant to be public
These keys are designed to sit in front-end code. Check the settings that protect them.
Check by check
Found a key and not sure what to do?
Send us your result and we'll reply personally with what to revoke first and how to move each key out of your front-end code. We only receive the key types and where they were found, never the keys. Free, with no obligation.
This is an automated check of the code you provide, not a security audit. If you find a live secret key, revoke it with the provider first.
The guide
How do API keys end up on a website?
Everything in your website's HTML and JavaScript is downloaded by every visitor, and anyone can read it with View Source. A key ends up there when code that should run on a server runs in the browser instead, usually to get a feature working quickly.
The most common route is an environment variable with a public prefix. Next.js inlines any variable starting NEXT_PUBLIC_ into the JavaScript sent to the browser, and Vite's documentation says VITE_ variables should not contain sensitive information such as API keys. Name a secret that way and it ships to everyone.
Why it matters
- 28.65 million new secrets, such as API keys and passwords, were found in public GitHub code in 2025, up 34% on the year before, according to GitGuardian's State of Secrets Sprawl 2026.
- Secrets for AI services were the fastest-growing kind: 1,275,105 leaked, up 81%.
- Leaked keys stay dangerous. Of the secrets GitGuardian confirmed as valid in 2022, more than 64% still worked when it retested them in January 2026.
Those figures cover code repositories. Website code is just as public, and people searching for keys read both.
Which keys are safe to be public?
Some services issue keys that are meant to sit in front-end code, because the service limits what they can do. Others give full access and must stay on your server.
| Key | Starts with | Public? | Why |
|---|---|---|---|
| Stripe publishable key | pk_live_ | Yes | Stripe says it can go in front-end code. |
| Stripe secret or restricted key | sk_live_, rk_live_ | No | Server only. It can act on your Stripe account. |
| Supabase publishable or anon key | sb_publishable_ | Yes | Supabase says it’s safe to expose, because Row Level Security limits what it can reach. |
| Supabase secret or service_role key | sb_secret_ | Never | It bypasses Row Level Security, so it can read and change your whole database. |
| Firebase API key | AIza | Yes | Firebase says these keys aren’t secrets. Your data is protected by Security Rules. |
| Google Maps API key | AIza | Yes, restricted | Google recommends restricting it to your website and the APIs you use. |
| Gemini API key | AIza | No | Firebase's own guidance says a Gemini key should never be included in your code. |
| OpenAI, Anthropic and other AI keys | sk-proj-, sk-ant- | No | Usage is billed to you, so anyone with the key can spend your money. |
What the checker looks for
The checker matches the published formats of more than 40 types of key and token, decodes Supabase keys to see which role they carry, and looks for random-looking values in variables named like secrets. It groups what it finds into eight checks.
-
Payment keys
Stripe secret, restricted and webhook keys, plus Square, Braintree and PayPal tokens. A live payment key in front-end code can let someone issue refunds, read customer data or create charges.
How to fix: Roll the key in your payment provider's dashboard straight away, check recent activity, then move every call that needs it to your server.
-
AI service keys
Keys for OpenAI, Anthropic, Google Gemini, Hugging Face, Replicate, Groq and xAI. These are billed by usage, so a leaked key can run up charges on your account within hours.
How to fix: Revoke the key in the provider's dashboard, set a spending limit, and call the AI service from a server function that keeps the key out of the browser.
-
Cloud and database credentials
AWS access keys, Google Cloud service accounts, Azure storage keys, Supabase secret and service_role keys, and database connection strings with passwords in them.
How to fix: Rotate the credential, check your cloud provider's logs for activity you don't recognise, and only use these keys in server-side code.
-
Developer and platform tokens
GitHub, GitLab and npm tokens, Shopify admin tokens, Google OAuth client secrets and Mapbox secret tokens. These can give access to your code, your store or your accounts.
How to fix: Revoke the token where it was created and replace it with one that only has the permissions it needs, stored on your server.
-
Email and messaging keys
SendGrid, Mailgun and Mailchimp keys, Twilio key IDs, Slack tokens and webhooks, Discord webhooks and Telegram bot tokens. These can be used to send messages or emails as your business.
How to fix: Revoke the key or delete the webhook, create a new one, and send messages from your server rather than the browser.
-
Private keys and passwords
Private keys, usernames and passwords inside URLs, and values with names like
apiKey,secretorpasswordthat look random enough to be real.How to fix: Remove the value from your front-end code, change the password or replace the key, and check what it was used for.
-
Environment variables
Variables with a public prefix such as
NEXT_PUBLIC_,VITE_orREACT_APP_whose names suggest a secret, and anything that looks like the contents of a.envfile.How to fix: Rename the variable without the public prefix and only read it in server code. If a
.envfile can be downloaded from your website, delete it from the server and rotate everything in it. -
Source maps
Links to source map files, and source maps that include your original code. Published source maps let anyone read your code as you wrote it, comments included.
How to fix: Stop publishing source maps to your live site, or upload them privately to your error-tracking tool instead.
What to do if you find a secret key
- Revoke or roll the key now, in the provider's dashboard. Deleting it from your code isn't enough, because copies already exist in browsers, caches and web archives.
- Check for misuse. Look at the provider's usage, billing and logs for anything you don't recognise, and set a spending limit where you can.
- Move the call to your server. Use an API route or serverless function that reads the new key from a server-only environment variable, and have your front end call that instead.
- Rename public variables. Remove
NEXT_PUBLIC_,VITE_orREACT_APP_from anything secret. - Lock down the public keys too. Switch on Supabase Row Level Security and Firebase Security Rules, and restrict Google keys to your website.
- Scan again after you deploy, and after every big change.
What the checker can't see
- Code you don't give it. Pages behind a login, and scripts that load later, need scanning too. Run the bookmarklet on each important page.
- Whether a key still works. It never contacts the provider, so treat every secret it finds as live until you've revoked it.
- Unusual key formats. Keys without a recognisable format are only caught when they sit in a variable with a secret-sounding name.
- Your server. Check that
/.envand/.git/configon your domain return a 404.
How to read your result
Secrets are keys that give access to a paid service, your data or an account. Items to review are things worth checking that aren't necessarily dangerous, such as test-mode keys and source maps. Public keys are listed separately and don't affect the result.
Secret keys found
At least one key in this code gives access to a paid service, your data or one of your accounts, and anyone who visits your site can copy it. Revoke and replace it first, then move it to your server.
Worth a closer look
No live secret keys, but some things need checking, such as source maps, test keys or values that look like passwords.
No secret keys found
None of the key types we check for turned up in this code. Keys that are meant to be public are listed separately so you know they're fine.
Frequently asked questions
Is it safe to paste my code here?
Yes. The checker runs entirely in your browser, and your code and any keys in it are never sent to us or anyone else. Keys are shown masked in the results. If you ask us for a review, we only receive the type of each key and where it was found, never the key itself.
Which keys are fine to leave on my website?
Keys designed to be public: Stripe publishable keys, Supabase publishable or anon keys, Firebase API keys, Google Maps keys and Mapbox public tokens. The checker lists these separately. They're safe because the service limits what they can do, so make sure Row Level Security, Firebase Security Rules or key restrictions are switched on.
I found a secret key. Is deleting it from the code enough?
No. Once a key has been on your website, assume someone has copied it. Revoke or roll it in the provider's dashboard first, so the old key stops working, then check the provider's usage and logs for activity you don't recognise. Only then deploy the code without it.
What does the bookmarklet do?
It reads the page you're on and the JavaScript files it loads from the same website, joins them together and copies them to your clipboard so you can paste them here. It doesn't send anything anywhere, and scripts from other websites, such as analytics, are skipped. The full code is in the link itself.
Why does it flag source maps?
Source maps turn your compressed JavaScript back into the original files, comments and all. That makes keys, internal URLs and business logic much easier to find. They're useful for debugging, so upload them privately to your error-tracking tool rather than publishing them.
Why do AI-built websites leak keys?
The quickest way to call a paid API is straight from the browser, and AI coding tools and app builders often take it when asked to make a feature work. The key then ships to every visitor. Ask the tool to move the call into a server function and keep the key in a server-only environment variable.
Can I check someone else's website?
The checker is built for your own sites. If you come across a key on someone else's site, tell them privately and don't use it.
Does it check my server or my code repository?
No. It only reads the code you paste or upload. To check your server, make sure addresses like yourdomain.com/.env and yourdomain.com/.git/config return a 404. For your repository, switch on your Git host's secret scanning.
Keep going
Related free tools.
Free · 8 checks
Domain Hijack Checker
Could someone hijack your domain? Check its registrar locks, renewal date, DNSSEC, CAA record and forgotten subdomains, with a score out of 100 and a fix for every gap.
Free · 10 checks
AI Prompt Injection Scanner
Is your website hiding instructions for AI? Paste a page's HTML to find invisible text, comments, attributes, schema and Unicode tricks aimed at ChatGPT, Claude and AI agents.