Get API Key API

Exposed Secrets Scanner

Check whether a website is accidentally leaking API keys, credentials, or sensitive files

This tool scans a site for the most common ways secrets get exposed by mistake: publicly reachable .env files, exposed .git folders, leftover backups and database dumps, and API keys or tokens hardcoded into the page's HTML or JavaScript. Any secret it finds is masked — you'll see enough to locate and rotate it, never the full value.

To keep this tool strictly self-service, you can only scan a domain after proving you control it: you'll be asked to publish a small tools-ninja-verify.txt file at the site's root — exactly like an ads.txt. If the file isn't there, the scan won't run.

Scan only sites you own or are authorized to test

Scanning websites you don't control may be illegal in your jurisdiction (e.g. the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK, or equivalent laws). Use this tool exclusively on your own properties or where you have explicit written permission.

Enter a domain or full URL. The scan checks the site's root and its linked scripts.

Scanning — checking sensitive paths and linked scripts…

Disclaimer. This scanner performs lightweight, non-intrusive checks for accidental exposure only — it does not attempt to exploit, brute-force, or bypass any protection, and it is not a substitute for a professional security audit. A clean result does not guarantee a site has no vulnerabilities. Detected secrets are masked and are not stored. You are solely responsible for ensuring you are authorized to scan any target. Tools Ninja accepts no liability for misuse.
Found this useful? Share it