Validate leaked API keys across 153 services + scan source code for known key formats - gitleaks-style, but in your browser.
KeyHacks is the reference for what to do after you find a secret. For 153 services across 19 categories - cloud (AWS, GCP, Azure, DO, Linode, Hetzner, Cloudflare, Vercel, Netlify, Render, Fly.io), payments (Stripe live/test, Square, Braintree, Razorpay, Plaid), AI/ML (OpenAI, Anthropic, Cohere, Hugging Face, Replicate, Mistral, Groq, Perplexity), messaging (Slack bot/user/app/webhook, Discord, Telegram, Twilio, Vonage, MessageBird), email (SendGrid, Mailgun, Postmark, Mailchimp), databases (MongoDB Atlas, Supabase, PlanetScale, Neon, Upstash, Pinecone, Weaviate), auth (Auth0, Okta, Clerk, Stytch, Cognito), observability (Datadog, New Relic, Sentry, PagerDuty), CRM (HubSpot, Salesforce, Klaviyo), productivity (Notion, Airtable, Linear, Atlassian), Web3 (Infura, Alchemy, QuickNode, Etherscan, Moralis), social, search, storage and more - the tool shows the exact validation request, the security impact, and the regex pattern that identifies the key in code.
Two modes: Browse - filter the 153-entry library by category, severity (low / medium / high / critical) or free-text search, then copy the read-only curl/CLI call to confirm whether a key is live. Scan - paste source code, a .env file, a minified JS bundle, or any text; the tool regex-matches against every high-signal key format in the library and returns hits with severity + impact + masked sample. 100% client-side - pasted text never leaves your browser.
Reporting a raw key is weak. Reporting that the key authenticates, with the specific impact statement (e.g. "Charges to OpenAI account, no upper cap unless org-set"), is a valid, high-impact bug.
.env file, a webpack bundle or a memory dump into Scan mode and the tool tells you every recognised secret format inside - severity-sorted.The validation commands shown are minimal and read-only by design (e.g. sts get-caller-identity for AWS, auth.test for Slack, users/me for Twitter). Never use a leaked key to modify data, run write operations or generate billable usage. Authentication confirmation is enough impact for any bug-bounty report. Stay within authorised scope; in some jurisdictions even read-access to a system you don't own is unauthorised access.
Every entry in the library has a regex matching its canonical key format. Scan mode runs all 74 high-signal regexes (the ones with at least 3 literal anchor characters like AKIA, ghp_, xoxb-, sk-) against your pasted text in your browser. Matches are deduped, severity-sorted, and masked (only first 8 + last 4 chars shown) to reduce the risk of accidental leakage to onlookers. Generic-format patterns (e.g. just [a-f0-9]{32}) are intentionally skipped to avoid false-positive floods.
Patterns without a distinctive prefix (e.g. plain 32-hex strings) match too many innocent strings and would drown out real findings. They're still usable in Browse mode where you have context. For broader scanning use dedicated tools (gitleaks, trufflehog) with the regex patterns from this library.
No. 100% client-side. The JSON catalog is fetched once on load. After that, scan mode runs entirely in your browser; pasted text is processed and discarded locally.
Those are CLI tools that scan filesystems / git history. KeyHacks Scan is a quick-paste interactive companion: drop in a JS bundle or a single file, get an instant severity-ranked report. Use both: Scan for fast triage, gitleaks/trufflehog for full repo / org-level scans.