Credential Scrubber finds hardcoded passwords, API keys, and connection strings in your code, and masks them — before you paste anything into an AI chat, a ticket, or a pull request.
Scanning runs on your device. Your files are never uploaded.
It happens faster than you'd think — and it only takes once.
A hardcoded credential can end up somewhere you don't expect — and the cost of that can be high.
Same detection engine underneath. Pick whichever fits how you work.
Open it in your browser, drop in a folder, get a cleaned copy back. Everything happens on your own device using your browser's own file access — nothing is ever uploaded to a server, even though there's nothing to install.
Try it nowA full desktop app for Windows: manage multiple projects, track scan history over time, edit detection rules, and scan only what changed since your last commit.
DownloadMasking a secret is only useful if the AI can still do its job without it. So we ran a controlled experiment: the same AI coding agent, given the same files, once with the real values and once with the sanitized version — then scored by hand to see if anything was lost.
Across 48 matched comparisons, most of what we measured held up. Correctness and consistency were essentially unchanged between the two versions. Usefulness showed a statistically distinguishable difference in a minority of cases — 7 of 48 pairs — concentrated in two kinds of tasks (generating tests and suggesting refactors), where the sanitized version scored lower. Completeness showed a similar, smaller pattern that didn't clear our significance threshold. We also ran a control where the "sanitized" file was byte-identical to the original — and one of its pairs still changed, which tells us some of this variation comes from the AI itself, not just from sanitization. Across all 96 responses, we found zero cases of the AI merging two different secrets together, splitting one secret into two, reconstructing a real value, or generating code that wouldn't run because of a placeholder.
This is one evaluation pass, on one AI model, over 9 hand-picked files — not a large study, and not a claim that this works the same way for every model, every codebase, or every kind of secret. It doesn't test resistance to a malicious AI agent, and it doesn't prove sanitization caused every difference we saw — see the control above. We're publishing the full methodology and every score so you can check our work.