# Screenshot Secret Scanner: Find Leaked API Keys & Passwords - [Home](/) - - - [Tools](/tools/) - - - Screenshot Secret Scanner # Screenshot Secret Scanner: Find Leaked Keys Before You Share Paste or drop a screenshot and check it for API keys, tokens, passwords, card numbers and other details you didn't mean to show. Each finding is marked on the image, and you can save a copy with solid black boxes over the ones you pick. The screenshot is read on your device and never uploaded. Paste a screenshot, drop it here, or click to choose PNG - JPG - WebP - up to 50 MB - stays on your device Choose screenshot On first use the text-recognition engine and English language data (a few megabytes) download from dragbin.com; your screenshot is never uploaded. [Text recognition by Tesseract (Apache-2.0)](https://github.com/tesseract-ocr/tesseract) - [tesseract.js (Apache-2.0)](https://github.com/naptha/tesseract.js) - [English language data from tesseract.js-data (MIT)](https://github.com/naptha/tessdata) Free to UseNo hidden chargesNo Software InstallationRuns in your browserNo Sign UpStart instantly ## Share files without screenshots of secrets Instead of screenshotting a config file or credential to a colleague, send the file itself end-to-end encrypted, so only the person with the link can open it. DragBin protects files with [client side](/client-side-encryption/), [quantum resistant encryption](/post-quantum-encryption/) (ML-KEM + AES-256) keeping sensitive data private with a [zero knowledge](/zero-knowledge-encryption/) security architecture. - Get 5GB quantum resistant storage forever - Unlimited sharing, unlimited bandwidth and unlimited file size uploads - Integrated Global CDN and preview media in 4k/8k [Try DragBin Today](https://dragbin.com) ## How to Check a Screenshot for Secrets Checking a screenshot before you post it takes three steps: Step 1 Paste a screenshot from the clipboard, drop it on the page, or choose an image file. Step 2 Wait while the text is read and scanned, then review each numbered finding and its severity. Step 3 Choose what to black out and download the redacted PNG, ready to share. ## Why Scan Screenshots for Secrets? Screenshots of terminals, dashboards, config files and chats are where keys and personal details slip out most easily, because nobody reads every line before hitting send. ### Catches Keys People Miss Looks for cloud, code-hosting, payment and AI API keys, tokens, private keys and connection strings with passwords. ### Flags Personal Data Too Card numbers, IBANs, Aadhaar and PAN numbers, email addresses and phone numbers are listed separately from credentials. ### Free, No Signup No account and no email address. Open the page and paste a screenshot. ## Built for Sensitive Images A tool that looks for secrets should not need to see them on a server. Everything here runs in your browser tab. ### Stays on Your Device Text recognition and scanning run locally. Only the recognition engine itself downloads from dragbin.com the first time. ### Solid Boxes, Not Blur Redaction paints opaque black boxes over the matched text, so nothing of the original characters is left to recover. ### Works Anywhere Runs in current desktop and mobile browsers with mouse, touch or keyboard. Paste straight from the clipboard. ## Try DragBin Today Pair private, in-browser file tools with zero-knowledge, quantum-resistant cloud storage. 5GB free, forever. [Claim 5GB free storage (opens in new tab)](https://app.dragbin.com/signup) ## Frequently Asked Questions ### Is my screenshot uploaded anywhere? No. The screenshot is read, scanned and redacted inside your browser and never leaves your device. The first time you scan, the text-recognition engine (Tesseract) and its English language data download from dragbin.com, a few megabytes in total. After that your browser can reuse its cached copy. No image, text or finding is sent to us or anyone else. ### What kinds of secrets and personal data does it look for? Credentials: AWS access keys and secret keys, GitHub and GitLab tokens, Slack tokens and webhook URLs, Stripe keys, Google API keys, OpenAI-style and Anthropic API keys, JSON Web Tokens, private key blocks, bearer tokens, database connection strings with a password, and password, secret, token or API key assignments. Personal data: payment card numbers, IBANs, Indian PAN and Aadhaar numbers, email addresses and phone numbers. Card numbers, IBANs, Aadhaar numbers and JWTs must also pass their checksum or format check, which keeps false alarms down. ### Can it miss something? Yes. Detection works on the text that optical character recognition reads from the image, so very small, blurry, low-contrast, rotated or handwritten text can be misread or missed entirely. The rules also only recognise known patterns, so a password with no label next to it, or a key format not on the list, will not be flagged. Treat a clean result as a helpful second look, not a guarantee, and check the image yourself before you share it. ### Why does the redacted copy use black boxes instead of blur? Blur and pixelation can sometimes be partly reversed, especially on short strings such as keys and card numbers, because the original characters still shape the blurred pixels. The redacted copy paints solid black boxes over the matched text, so the covered pixels are replaced and nothing of the original remains under them. The download is a new PNG, so it also carries none of the original file's metadata. ### A real key showed up in my screenshot. What should I do? Redacting the screenshot stops the next leak, but if the image was already posted or sent, assume the key is exposed. Revoke or rotate it with the service that issued it, change any password that appeared, and review recent activity on the account. A strong password generator and an email breach checker can help with the follow-up. ### Which images can I scan? Any image your browser can open, such as PNG, JPG, WebP, GIF (first frame) and AVIF, up to 50 MB and 50 megapixels. Paste a screenshot straight from the clipboard, drop it on the page, or choose a file. Text recognition is set up for English characters, which covers keys, tokens and most code. More free tools ## Keep going with the DragBin toolbox [ ### Image to Text Copy all the text out of a screenshot or photo, right in your browser. ](/tools/image-to-text/)[ ### Redact Image Draw your own black boxes over anything else you don't want to share. ](/tools/redact-image/)[ ### Email Breach Checker See whether an email address appears in known data breaches. ](/tools/email-breach-checker/) --- Canonical: https://www.dragbin.com/tools/screenshot-secret-scanner