Secret Pattern Sample Checker

Secrets leak into places built for sharing: configuration snippets, build logs, support tickets, copied headers, infrastructure plans, and screenshots. Provider-specific tokens often have recognizable prefixes and lengths, while passwords and connection strings may reveal themselves only through a sensitive name, an opaque value, or surrounding context.

Pattern scanning is triage. A strong signature can identify a value that deserves immediate containment, but a matching shape does not prove that the credential is live. Entropy can help find random-looking assignments, yet it also catches hashes, identifiers, fixtures, and compressed data. Conversely, a short or predictable secret may have low entropy and evade generic scoring.

When a real secret may have been exposed, removal from the visible text is not enough. Revoke or rotate it at the issuing service, update dependent systems, inspect relevant activity, and remove the value from logs, tickets, or history where policy permits. Masked evidence reduces accidental redistribution during review, but masking does not contain the original exposure.

How to Use This Tool:

Use the smallest relevant excerpt and keep exact values masked during ordinary review.

1. Paste a config, log, ticket, header, infrastructure, dotenv, or code excerpt under Sample text. Give it a harmless label that contains no credential.
2. Choose Balanced review for normal triage, Strict high-confidence patterns to reduce generic findings, or Broad triage for a wider manual sweep.
3. Keep Masked evidence enabled. Include generic assignments for config and dotenv text; disable them when only recognized provider shapes matter.
4. Review critical and high findings first. Confirm the issuing service and context before escalating a sample cue or low-confidence assignment.
5. For a real exposure, revoke or rotate the credential outside the checker and investigate its use. Do not treat a cleared ledger as proof that the source is safe.

Interpreting Results:

The finding count covers the complete scan. The Finding rows limit affects only how many sorted entries are shown, so aggregate severity counts can be larger than the visible ledger.

• Critical identifies a private-key block. High usually identifies a provider-shaped token, credentialed URL, authorization value, or high-confidence generic assignment.
• Medium and Low generic findings need more context because their score is less decisive.
• A sample or test cue lowers generic confidence and adds a caution to direct-pattern evidence, but it never proves that the value is harmless.
• No findings means none of the supported direct signatures or enabled generic rules crossed their thresholds. It does not validate the text or search commit history.

Technical Details:

Scanning follows two paths. Direct signatures search the complete text for known token, key, authorization, and connection-string shapes. Contextual assignment rules then inspect sensitive names and score non-overlapping values by length, entropy, character variety, and sample cues.

Rule Core:

Direct findings are not filtered by the scan profile or entropy threshold. Generic assignments are considered only when the name contains a sensitive term such as password, token, secret, API key, private key, authorization, session, cookie, credential, or connection string. A direct match takes precedence when the same character range would otherwise be scored again.

Formula Core:

Shannon entropy measures the character distribution of a candidate value. Repeated characters lower the result; a more even mixture raises it.

H is bits per character. R is the generic assignment score; L, E, X, and K are length, entropy, character-class, and key-name points, while D is a sample-cue deduction.

A 32-character value under an API-key name scores 82 when its entropy earns 17 points, it uses three character classes, and no sample cue applies: 18 + 18 + 17 + 8 + 21 = 82. That reaches high confidence and passes every profile cutoff.

The default entropy threshold is 3.7 bits per character and can be set from 2.5 to 5.5. Broad, balanced, and strict profiles include generic scores of at least 32, 48, and 70 respectively. Included generic assignments are high confidence at 82 or above, medium at 58 to below 82, and low below 58; severity follows that confidence.

Values are scanned up to 1 MiB. Findings are sorted by severity, confidence, line, and pattern name. The visible row limit can be 10 to 300, while severity totals and pattern coverage continue to describe the complete scan.

Privacy and Responsible Use:

The sample is scanned in the browser and no provider is contacted. Keep masking enabled: it shortens values in tables, copied rows, and downloads, but the editable source still contains the original text.

• Do not unmask findings in screenshots, tickets, shared calls, or broadly retained evidence.
• No validity check, account lookup, repository-history search, or provider revocation occurs.
• For a plausible real exposure, contain first: revoke or rotate, update dependants, inspect activity, and remove exposed copies according to incident policy.

Worked Examples:

References:

• Supported secret scanning patterns, GitHub Docs.
• Secrets Management Cheat Sheet, OWASP Cheat Sheet Series.
• How to set Symfony secrets, Simplified Guide.