Trust

The guard, in your browser

This page runs the same guard the Forge and the Ship Check run, in your browser. Nothing you paste is sent anywhere. A hit names the field, never the value.

Paste a snippet or a JSON file

What the guard looks for · Patterns 1.1.0

A[KS]IA[0-9A-Z]{16}
sk-(?:proj-)?[A-Za-z0-9_-]{20,}
gh[posru]_[A-Za-z0-9]{20,}
github_pat_[A-Za-z0-9_]{20,}
AIza[0-9A-Za-z_-]{20,}
xox[baprs]-[A-Za-z0-9-]{10,}
eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}
:\/\/[^\s/:@]+:[^\s/:@]+@
BEGIN[A-Z ]*PRIVATE KEY
(?<![A-Za-z0-9/+=])(?=[A-Za-z0-9/+]*[A-Z])(?=[A-Za-z0-9/+]*[a-z])(?=[A-Za-z0-9/+]*[0-9])[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+=])
(?:[Kk]ey|KEY|[Tt]oken|TOKEN|[Ss]ecret|SECRET|[Pp]assword|PASSWORD)["':= ]{1,4}[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}

And one rule beyond the patterns: a run of 24 or more characters, with letters and digits, whose entropy reaches 3 bits per character. Separators such as spaces, slashes, dots and dashes cut the runs.

What it misses, written down

It is a heuristic. These cases pass it, and the record says so:

a short password with a capital, digits and a sign
a long passphrase of words