I accidentally pasted an API key into ChatGPT — now what?

First: rotate that key now — once it left your machine you must treat it as compromised. Then make sure it never happens again: scan and redact secrets before pasting into any AI chat. Everything below runs locally in your browser.

I already sent my key to an AI chat — what do I do?

1. Revoke or rotate the key immediately — in your provider dashboard (OpenAI, AWS, Stripe, GitHub…). Do this before anything else. Assume the key is compromised the moment it left your clipboard.
2. Check usage logs — look for API calls you did not make. Most providers show per-key usage.
3. Audit what else was in that paste — internal hostnames, file paths, customer emails. Redact them in future.
4. Change the habit, not just the key — run future pastes through this scanner first. It takes ten seconds.

What does this scanner detect?

• Bearer tokens — Authorization: Bearer eyJ…
• API keys and secrets — values after api_key, token, secret, session, client_secret…
• Passwords — password, passwd fields
• Email addresses — replaced with <EMAIL_REDACTED>

Detected values are replaced with <REDACTED> placeholders — the structure of your text stays intact, so the AI can still debug your code or logs.

Is my data uploaded anywhere?

No. This page is a single static HTML file. The scan runs entirely in your browser — disconnect from the internet after it loads and it keeps working. Your secrets never touch our servers, because we have no servers.

Need the full toolbox?

This page is one tool from LocalDevToolbox — 15+ local developer tools: context optimizer, stack trace analyzer, log doctor, cURL converter, JWT decoder and more. No account, no upload, no usage limit.