Free tool

Is your website leaking API keys?

A secret key in your website's JavaScript is public: anyone can open the browser's developer tools and copy it. Researchers scanning ten million websites found more than 1,700 live keys this way. Check yours in a few seconds.

• What it checksYour page and the scripts it loads from your own domain: the code every visitor's browser downloads.
• Keys stay maskedOnly the start and the last four characters are shown. Vallkey never tries a key and keeps nothing.
• Your site onlyCheck websites you own or may check. A few checks an hour per visitor.

Keys in your code, not just your website

Keys also leak through code pushed to GitHub, .env files shared by mistake, and logs. The Vallkey command line tool checks a project, its .env files and its Git history, on your own computer.

npx vallkey scannpx vallkey scan --history   # every commit, too

Found a key? Read what to do in the next ten minutes and how to keep keys out of the browser.