Clean code and text before you paste it.
Strips what you list and proves it, all in your browser. Flags what else looks sensitive. Your text never leaves this device, and nothing is stored.
We don’t tell you the result is safe. We make it small enough that you can tell.
Code, a log, a stack trace, a config dump.
Removed provably, every occurrence. This is the claim the receipt stands behind.
Deny-listed strings replaced with labelled placeholders.
The checkable receipt (JSON)
Patterns the scanner flagged — for you to decide
Best-effort guesses; nothing here is touched in your output. Add a real one to your list above and process again — you decide, the tool acts.
Vault — placeholder to original
Round-trip — restore your originals
Paste the reply you got back; every placeholder swaps back to the original, in your browser.
Verify any text against the ruleset
The same scan the receipt runs, on its own. Paste anything and see what the ruleset still finds — zero means it flags nothing in that text, a floor, not a guarantee. Shown against your own text, never a scoreboard about anyone else.
What this won’t do — and why, out loud
- — It won’t tell you the output is safe. Safety depends on what you named and on where the output goes next. It removes what you list, provably, and shows you the rest so you can judge.
- — It won’t remove the flagged patterns for you. Those are guesses, and only you know which are real. You promote them; the tool acts.
- — The receipt doesn’t prove when. An offline tool has no trusted clock, so it attests what and which tool — never a timestamp it couldn’t stand behind.
- — The scanner is best-effort, and labelled as such. It helps you build a good list; the provable floor is the list you name, not the guesses.
Pattern detection uses a Gitleaks-derived rule set; the engine is ours.
We invite you to double-check our work
Open your browser’s developer tools, switch to the Network tab, and process something. Nothing leaves your device.
The whole source is on GitHub. Read it.
Found a bug, or a claim that doesn’t hold up? Tell us — an example helps enormously, though we understand if yours is too sensitive to share: code@geodeforge.com
That’s the difference between a privacy policy and a fact.
This slot pays for the page
One static, labeled sponsor link — an image we host and a plain link. No ad network, no tracking script, no third-party request. That is the entire business model, and it is why nothing above has a price.
Sponsor this slot →Remove API keys and secrets from code before you share it.
Pull the keys, tokens, and connection strings out of a snippet before it goes into a chat, a pull request, or a public question — the work happens in this browser tab, and a receipt shows you exactly what was removed.
Where secrets hide in code
A secret is any string that grants access or exposes your internals, and in code it rarely sits in an obvious place. It hides in a comment left in while debugging, a config default, a committed .env, a connection string, a header in a saved request. Before a snippet goes anywhere, these are the strings worth pulling:
- API keys and access tokens — the credential that authenticates a request.
- Connection strings — database and service URLs with a username and password baked in.
- Session tokens and JWTs — short-lived, but live access while they last.
- Private keys and certificates — SSH keys, signing keys, TLS material.
- Passwords hard-coded into scripts or config files.
- Internal hostnames, IPs, and endpoints that map your network for anyone reading.
You decide the list. Paste the code into GeodeCode above, add the exact strings to remove, and every occurrence is replaced with a labelled placeholder.
How the removal happens
The tool runs in JavaScript inside this browser tab. Your code goes into the box, the work happens right here, and there is no server behind the page — so the text does not leave your device and nothing is stored.
Every run produces a re-runnable receipt: a small JSON record of what was removed and how many times each string was found. It is there so you can confirm the claim instead of trusting it — run the same input again and the receipt matches.
Alongside the strings you name, the scanner reads the rest of the snippet and flags anything else that looks like a credential — a key, a token, an address it recognises — and leaves it in place for you to judge. It points; you decide what to add to the list.
Want to check that nothing is uploaded? The double-check our work section on this page walks you through watching your browser’s Network panel while you run a clean, and the verify box lets you scan any text against the same ruleset on its own.
What it does not do
- It does not rewrite your Git history. If a secret was already committed, cleaning the pasted copy changes nothing in the repository — the value stays in the log until the history is rewritten with a tool built for that, such as
git filter-repoor BFG. Purge it at the source, and rotate it. - It does not declare your output safe. It removes what you name, provably, and shows you the rest. Whether that is enough depends on what you named and where the snippet goes next — that judgement stays with you.
- It does not guess perfectly. The scanner is best-effort and labelled as such. The provable floor is the list of strings you name, not the extra candidates it offers.
Already shared or committed a key? Rotate it first
If a key has already gone into a chat, a pull request, or a pushed commit, treat it as exposed and rotate or revoke it now — once a value has left your hands, retiring it is the only reliable fix, and there is no way to un-send it. If it was committed, rewrite the history at the source as well. Then clean the code before you share it next time, so the secret never rides along.
Questions people ask
How do I remove an API key from my code before sharing it?
Paste the snippet into GeodeCode above, list the exact strings to remove, and every occurrence is replaced with a labelled placeholder. The work runs in this browser tab, so the code does not leave your device, and a receipt records what was replaced.
What counts as a secret in my code?
API keys and access tokens, database and service connection strings, session tokens and JWTs, private keys and certificates, hard-coded passwords, and internal hostnames or endpoints. You name the exact strings to remove; the scanner flags further candidates it recognises for you to add.
Can I clean a code snippet without uploading it anywhere?
Yes. There is no server behind this page, so the snippet stays on your device, nothing is stored, and the receipt lets you confirm exactly what changed.
What about a key I already pushed to a Git repository?
Cleaning the snippet here does not touch your repository history. A committed value lives in the log until the history is rewritten with a tool built for that — git filter-repo or BFG — so do that at the source, and rotate the value regardless.
I already shared a key — is it compromised?
Treat it as compromised and rotate or revoke it now. Once a value has been sent, retiring it is the reliable fix; there is no way to un-send it. Then clean the code before you share it next time.
More from GeodeForge
GeodeForge is a one-person studio that crafts open-source tools that do what they say, and let you check — in your browser.