Item logo image for Secret Scanner

Secret Scanner

5.0(

1 rating

)
ExtensionDeveloper Tools98 users
Item media 1 (screenshot) for Secret Scanner

Overview

Scan web pages for API keys or passwords

Scan JavaScript files loaded by websites for embedded secrets like private keys or passwords. Pages are automatically scanned in the background, and the number of found secrets is shown in the extension icon in the toolbar. Click the extension icon to see details. If a secret is meant to be public (e.g. a restricted Google Maps API key), click "Ignore on <site>" to hide it on that site from now on. Ignored secrets are moved to a collapsed section inside the popup. Only a hash of each ignored secret is stored. Limitations - Used bandwidth may increase. Consider only enabling the extension when needed on metered mobile connections. - Detected secrets may be false positives - May not catch dynamically constructed or obfuscated secrets - Does not scan scripts only loaded by other scripts. This extension is open source software licensed under the MIT license.

5 out of 51 rating

Learn more about results and reviews.

Details

  • Version
    0.8.0
  • Updated
    October 20, 2026
  • Offered by
    Christian Pulvermacher
  • Size
    24.97KiB
  • Languages
    English
  • Developer
    Email
    pulvermacher.christian@gmail.com
  • Non-trader
    This developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.

Privacy

Manage extensions and learn how they're being used in your organization

Secret Scanner has disclosed the following information regarding the collection and usage of your data. More detailed information can be found in the developer's privacy policy.

Secret Scanner handles the following:

Authentication information
Website content

This developer declares that your data is

  • Not being sold to third parties, outside of the approved use cases
  • Not being used or transferred for purposes that are unrelated to the item's core functionality
  • Not being used or transferred to determine creditworthiness or for lending purposes

Related

JS Recon Buddy

5.0

Analyze page scripts for bug bounty reconnaissance.

XSSassin - Web Security Payload Injector

5.0

Security testing: inject payloads into input fields. XSS, SQLi, optional Smart-Injection (heuristic category) and more.

SecretSifter: Live Credentials & Secrets Scanner

5.0

Detects secrets, API keys, and tokens in JS, JSON, XML, and HTML at runtime

DotDrop - Sensitive File Detector

0.0

Detects exposed sensitive files (.git, .env, SSH keys, AWS credentials). Essential security tool for researchers & developers.

OWASP Penetration Testing Kit

4.8

OWASP Penetration Testing Kit

PentestPro.ai Security Scanner

5.0

Pentest Pro - Detect real security flaws in seconds, no risk to production.

Sensitive Info Scanner

0.0

Scans webpages for potentially sensitive information like email addresses, internal IPs, or certain keywords.

EnvVars

0.0

Detect exposed environment variables and hardcoded secrets in React, Vue, Angular, Svelte, Next.js, and other frontend frameworks.

KeyFinder

0.0

Passively discovers API keys, tokens, and secrets leaked in page scripts, DOM, network responses, and browser storage.

CyberPost Lab

5.0

A fully offline, browser-based HTTP request testing tool for cybersecurity researchers

SecuriScanX

5.0

Harden your input points - detect SQLi, XSS & CMDi within seconds.

FindSomething

4.6

Find interesting things in the webpage's source code or JavaScript

JS Recon Buddy

5.0

Analyze page scripts for bug bounty reconnaissance.

XSSassin - Web Security Payload Injector

5.0

Security testing: inject payloads into input fields. XSS, SQLi, optional Smart-Injection (heuristic category) and more.

SecretSifter: Live Credentials & Secrets Scanner

5.0

Detects secrets, API keys, and tokens in JS, JSON, XML, and HTML at runtime

DotDrop - Sensitive File Detector

0.0

Detects exposed sensitive files (.git, .env, SSH keys, AWS credentials). Essential security tool for researchers & developers.

OWASP Penetration Testing Kit

4.8

OWASP Penetration Testing Kit

PentestPro.ai Security Scanner

5.0

Pentest Pro - Detect real security flaws in seconds, no risk to production.

Sensitive Info Scanner

0.0

Scans webpages for potentially sensitive information like email addresses, internal IPs, or certain keywords.

EnvVars

0.0

Detect exposed environment variables and hardcoded secrets in React, Vue, Angular, Svelte, Next.js, and other frontend frameworks.

Google apps