What kind of key is this?
Found a key in your code, a .env file or a chat and not sure what it is? Paste it to see which service it belongs to, whether it's meant to be public, and how to roll it if it leaked.
Runs in your browser. The key isn't sent to SniffPup or the provider, and isn't logged or stored. We only look at its prefix and shape, so we can't tell whether it still works.
Decode a Supabase JWT
Supabase's older keys and every signed-in session are JWTs. Paste one to see its role, project, when it was issued and when it expires. service_role means secret.
Decoded in your browser. The token isn't sent anywhere or stored, and we don't check its signature or contact Supabase.
What this checks
Keys from Supabase, Stripe, OpenAI, Anthropic, AWS, GitHub, Google / Firebase, Twilio, SendGrid, Slack, Resend, Hugging Face, Groq, Shopify, plus JWTs and PEM private keys. Matching is by prefix and format only.
What it can't tell you
- Whether the key still works, or what it has been used for. We never call the provider.
- Where else it has been copied. If a secret key was public even briefly, roll it.
- Whether a JWT is genuine. The decoder reads it but doesn't check the signature.
- Keys we don't know. An unknown format isn't a sign it's safe to share.
Leaked-key playbooks
Then check your live site
The free scan looks for secret keys in your site's HTML and JavaScript, public .env files and Supabase tables strangers can read.
This is covered by the main scan. There's no separate scanner: one free scan runs every check below on your live URL.
Run the main scan →What the main scan checks
Paste your site's URL and SniffPup checks it the way a visitor's browser would: 15 passive checks. It never logs in, never sends attack traffic and never keeps your data. You get a report sorted by severity, with fixes.
- Leaked API keys in your page and JavaScript: OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, Resend and more, plus public env variables (VITE_, NEXT_PUBLIC_ and similar) with names that sound secret
- Supabase key leaks: a secret or service-role key shipped to the browser
- Exposed .env files and other exposed files: .git, .npmrc, cloud credentials, SQL dumps, backups
- Source map exposure: is your original source code downloadable?
- Security headers (HSTS, CSP, clickjacking), cookie flags and the HTTPS redirect
- Your HTTPS certificate: expiry, issuer, name match and trust
- Supabase and Firebase exposed data: what a stranger can read with your public key (read-only, no row data downloaded)
- CORS: can any website read your pages as your users?
- Email spoofing protection: SPF, DMARC and DKIM
- Outdated JavaScript libraries with known security holes
- AI crawler access: what ChatGPT, Claude and Perplexity's crawlers can see, plus robots.txt and llms.txt
- Speed Doctor: a speed score and what slows your site down
- Crash Catcher: scripts that fail to load, blank pages, missing styles and dead links
- Accessibility basics, domain expiry, outside scripts and privacy and terms links
Leaked keys are listed by provider, with a link to the playbook. Free, passive and read-only, no signup. Only scan sites you own or are authorized to test. What the scanner does and never does.
Questions
Is my key sent to SniffPup?
No. The check runs in your browser. The key isn't uploaded, logged or stored, and the page makes no request when you press the button. The field is cleared after each check.
Do you check whether the key still works?
No. We never call the provider. We only look at the key's prefix and shape, so a match tells you what kind of key it is, not whether it's live.
Can I decode a JWT here?
Yes. The decoder on this page shows the header and payload, the role, project, issue and expiry dates in your browser. It never checks the signature or contacts Supabase.
Which keys can it identify?
Supabase, Stripe, OpenAI, Anthropic, AWS, GitHub, Google / Firebase, Twilio, SendGrid, Slack, Resend, Hugging Face, Groq, Shopify, plus JWTs and PEM private keys. For Supabase's older JWT keys it reads the role inside the token, in your browser, to tell anon from service_role.
It says my key is public. Is that fine?
Keys like the Supabase anon or publishable key, Stripe pk_ keys and Firebase web keys are meant to be in your app. They're only as safe as your database rules, row level security and API restrictions.