SecretSifter is a security tool for pentesters and developers that automatically detects exposed secrets, API keys, tokens, and credentials in real time.
Features: • Scans JavaScript, JSON, XML, and HTML responses as they load • Intercepts XHR, fetch, and WebSocket traffic via network hooks • Detects 80+ secret types: AWS keys, JWT tokens, GitHub tokens, Stripe keys, Google API keys, private keys, and more • DevTools panel with live findings table, severity classification, and source URL • Export findings as CSV or JSON • Download full list of scanned URLs • Per-domain on/off toggle — only scans sites you enable • All processing is local; no data leaves the browser
