Free secret scanner: find API keys and passwords in your code
Hardcoded secrets (API keys, access tokens, private keys and passwords committed to code) are one of the most common ways attackers get in, and one of the easiest to prevent. DepWarden's free secret scanner reads your source and configuration files against 33 secret and credential rules and flags what it finds, with the fix. No account is needed: paste code, upload a zip or connect a repository.
What it detects
ASP.NET machineKey hardcoded in config
AWS access key ID
Azure storage account key
Django SECRET_KEY hardcoded
GitHub personal access token
Hardcoded symmetric encryption key
JWT signed with weak or hardcoded secret
PGP private key block
Possible AWS secret access key
Private key embedded in source
Secret hardcoded in shell export
Stripe live secret key
API key or token in URL query string
ARG with secret-like default value
Copying secret file into image (.env / .ssh / credentials)
Database connection string with embedded password
DigitalOcean personal access token
GitHub Actions secret echoed in run step
Google Cloud API key
Hardcoded credentials
Heroku API key
JWT signed with hardcoded secret
Mailchimp API key
npm publish token
Private key or passphrase pattern in config
Secret value written to GITHUB_OUTPUT / GITHUB_ENV
Secret-looking value in ENV directive
SendGrid API key
Slack API token
Twilio account SID / auth token
Credentials embedded in URL
Firebase project credentials in source
Generic hardcoded API key or token
Each finding carries a severity and a CWE (for hardcoded credentials, CWE-798), and the snippet shown in the results has the secret value redacted.
Where it looks
Source code in every language the SAST scanner supports.
Configuration and secret-bearing files: .env, .pem, .key, .cer, .crt, .ini, .toml, .cfg, .conf, .properties, .json and .xml.
Infrastructure and CI files: Dockerfiles (ARG and ENV values, secret files copied into an image), GitHub Actions workflows and shell scripts.
If a secret is found
1. Rotate it first. Assume it is compromised. Removing it from the code does not un-leak it. 2. Remove it from the code and load it from an environment variable or a secrets manager. 3. Clean the history if it was committed, and check the logs of the service it unlocks. 4. Prevent a repeat: scan in CI, and consider a pre-commit hook so a secret never reaches the repository.
How it compares
Gitleaks and TruffleHog are well-known open-source secret scanners and are worth running as pre-commit hooks or in CI. Some scanners can test whether a found credential is still live; DepWarden does not, so treat every finding as needing rotation. DepWarden's advantage is speed and reach: nothing to install, and secret rules sit alongside 350 SAST rules in the same scan. See free SAST tools compared.
Frequently asked questions
Is the free secret scanner really free?
Yes, in the browser with no account. Running it from CI through an API key needs a plan that includes SAST.
Does it find secrets in git history?
It scans the files you paste, upload or connect (the current state of a branch). It does not walk old commits, so use a history-aware scanner such as Gitleaks or TruffleHog for that.
Are the results private?
Results stay in a private, session-isolated workspace you can clear at any time, and the snippets in findings have secret values redacted.