Leaked secret keys.
AI, cloud, payment and code-hosting keys that a site ships to every visitor by mistake: OpenAI, Anthropic, AWS, GitHub, Slack, SendGrid, private keys, database passwords and more.
Loading...
Chrome extension · Free
Spot exposed API keys before anyone else does.
KeySpotter checks the websites you open for leaked secret keys and test-mode payment setups. It only taps you on the shoulder when it is sure: a small alert in the corner, never a wall of popups.
What it catches
Payment bypass risks.
A live shop running on a Stripe, Braintree or Square test key may accept fake test cards as real orders. Most tools miss this. KeySpotter flags it.
Public keys, explained.
Some keys are meant to be public, such as Stripe publishable keys or Firebase browser keys. KeySpotter files these as information so they never raise an alarm.
How it works
- 1
It reads what the page already has.
That means the page source, the scripts the page loaded, browser storage, and the page's own API responses.
- 2
It scores every match.
Exact key formats, built-in checksums, randomness checks and placeholder filters produce a confidence score from 0 to 100. Keys shown inside code examples on tutorial pages are scored down, so documentation never triggers an alarm.
- 3
It alerts only when it is sure.
The corner alert appears only at 90% confidence or higher, once per finding per site. Everything else waits quietly in the full report.
The report
The full report shows four things for each finding:
- what was found
- where it was found
- how sure KeySpotter is, with the reasons ticked off
- what it means and how to fix it
From the report you can:
- export it as Markdown or JSON, always masked
- copy a polite, masked disclosure note for the site owner, addressed to their security contact when the site publishes one
Privacy, in plain words
- Found keys never leave your browser. KeySpotter never tests a key against any service.
- No accounts, no analytics, no servers.
- Full key values are kept only in session memory, which is cleared when you close the tab.
- It re-reads the scripts a page loaded so it can scan them. Cookies are only ever sent back to the site's own address.
Who it’s for
- Site owners and developers who want to catch a leaked key before someone else does.
- Security researchers and bug-bounty hunters who want a quiet, accurate signal while browsing.
FAQ
Will it slow down my browsing?
No. Scanning runs in the background after the page has loaded. Common library and analytics scripts are skipped, and each script is scanned only once per browser session.
Does it check whether a key works?
No, never. Testing someone else's key would mean using it. KeySpotter judges keys only by their exact format, checksums and context.
What permissions does it need?
None at install. On first run it asks to read the sites you visit, which it needs in order to scan them automatically. If you prefer, skip that and click the toolbar icon to scan just the current page.
What if it flags something by mistake?
Click "Mute site" on the alert, or turn on-site alerts off in Settings. The toolbar badge and report keep working.
Is it free?
Yes.