Clean code and text before you paste it.
Strips what you list and proves it, all in your browser. Flags what else looks sensitive, in pasted text or across a whole folder. Nothing leaves this device, and nothing is stored.
We don’t tell you the result is safe. We make it small enough that you can tell.
Code, a log, a stack trace, a config dump.
Removed provably, every occurrence. This is the claim the receipt stands behind.
It also finds what you listed when it is written another way: different capitals or accents, hidden characters, encoded spaces such as %20, a phone number in another format, or tucked inside base64.
Reads a contacts file (.vcf) or a spreadsheet saved as CSV, here in your browser, and adds each person’s names, emails, phone numbers, companies and street addresses to the list. Each family name can go on the list on its own too, so “Mr Roe” is found as well as “Jane Roe”. Notes, birthdays and photos are not read.
Deny-listed strings replaced with labelled placeholders.
The checkable receipt (JSON)
Patterns the scanner flagged — for you to decide
Best-effort guesses; nothing here is touched in your output. Add a real one to your list above and process again — you decide, the tool acts.
Vault — placeholder to original
Round-trip — restore your originals
Paste the reply you got back; every placeholder swaps back to the original, in your browser.
Verify any text against the ruleset
The same scan the receipt runs, on its own. Paste anything and see what the ruleset still finds — zero means it flags nothing in that text, a floor, not a guarantee. Shown against your own text, never a scoreboard about anyone else.
Scan a whole folder
Pick a folder and GeodeCode reads every file in it, here in your browser, and lists each line that looks like a key, token, password or other secret. Your browser may say it will “upload” the files: that is its standard wording for letting this page read them. This page cannot send anything anywhere, so nothing leaves your device.
Binary files (images, archives, compiled code) are listed but not read. For a check before you publish code, the same scan runs from the command line and fails when it finds something: get scan-folder.mjs from GeodeCode on GitHub and run node scan-folder.mjs your-folder.
What this won’t do — and why, out loud
- — It won’t tell you the output is safe. Safety depends on what you named and on where the output goes next. It removes what you list, provably, and shows you the rest so you can judge.
- — It won’t remove the flagged patterns for you. Those are guesses, and only you know which are real. You promote them; the tool acts.
- — The receipt doesn’t prove when. An offline tool has no trusted clock, so it attests what and which tool — never a timestamp it couldn’t stand behind.
- — The scanner is best-effort, and labelled as such. It does not find names or other personal details written as plain words, and it cannot tell whether a key still works. It helps you build a good list; the provable floor is the list you name, not the guesses.
Pattern detection uses a Gitleaks-derived rule set; the engine is ours.
We invite you to double-check our work
Open your browser’s developer tools, switch to the Network tab, and process something. Nothing leaves your device.
The whole source is on GitHub. Read it.
Found a bug, or a claim that doesn’t hold up? Tell us — an example helps enormously, though we understand if yours is too sensitive to share: code@geodeforge.com
That’s the difference between a privacy policy and a fact.
This slot pays for the page
One static, labeled sponsor link — an image we host and a plain link. No ad network, no tracking script, no third-party request. That is the entire business model, and it is why nothing above has a price.
Sponsor this slot →More from GeodeForge
GeodeForge is a one-person studio that crafts open-source tools that do what they say, and let you check — in your browser.