KeyDrift
Free scan

Free client bundle secret scanner

Paste a live URL and KeyDrift downloads the JavaScript your visitors download, then reports the credentials in it. Or paste a bundle directly — for code behind a login, or a chunk you already have.

No account. Read-only — the scanner only ever issues GET requests, and never stores a key: findings carry a masked prefix and a fingerprint.

Read-only

The scanner only ever issues GET requests. It cannot change anything on the site it is pointed at.

Nothing live is stored

A key exists as a string inside the detection engine and nowhere else. What is saved is a masked prefix and a salted fingerprint.

Public hosts only

Loopback, private ranges and the cloud metadata endpoints are refused before the socket opens, and re-checked on every redirect.