KeyFinder is an MIT-licensed browser extension for Chrome and Firefox that passively scans every page a visitor loads for leaked API keys, tokens, secrets, and credentials across more than 80 detection patterns with zero configuration, built for security engineers, penetration testers, bug bounty hunters, and developers who need to catch exposed credentials as they browse.

What it is

KeyFinder is a JavaScript browser extension distributed for Chrome and Firefox and built on the Manifest V3 service worker architecture. It runs silently in the background on every page load, inspecting the rendered page rather than requiring the user to invoke a scan. The codebase is pure vanilla JavaScript with zero dependencies, which means no jQuery and no external libraries are bundled, and the project is published under the MIT licence in the Browsers and Extensions category.

The concrete problem it solves is credential exposure on the client side. Secrets routinely leak into places that a casual page review misses: inline script blocks, script source URLs, meta tags, hidden form field values, data attributes, HTML comments, URL query parameters, localStorage and sessionStorage, and the bodies of XHR and Fetch responses. KeyFinder replaces the manual practice of opening browser developer tools and hand-searching page source and storage for sensitive strings, and it applies Shannon entropy analysis to surface random high-entropy strings that do not match a documented provider format at all.

Key capabilities

• Ships with 80+ detection patterns spanning cloud providers such as AWS access keys, secret keys, session tokens, and Cognito, plus Google Cloud API keys and OAuth tokens and Azure storage keys, SAS tokens, and connection strings.
• Covers source control tokens including GitHub personal access tokens, fine-grained tokens, and OAuth tokens, GitLab personal access, pipeline, and runner tokens, and Bitbucket credentials, alongside payments providers such as Stripe secret, publishable, restricted, and webhook keys.
• Detects database connection strings for MongoDB, PostgreSQL, MySQL, and Redis, infrastructure secrets for HashiCorp Vault, Terraform, Docker Hub, NPM, Cloudflare, DigitalOcean, Doppler, Pulumi, and Grafana, and private keys in RSA, EC, OpenSSH, PGP, and DSA formats.
• Scans ten attack surfaces per page: script src URLs, inline scripts, same-origin external scripts, meta tags, hidden form fields, data attributes, HTML comments, URL parameters, web storage, and network responses.
• Applies Shannon entropy analysis to flag undocumented secret formats that match no fixed pattern.
• Runs SPA-aware through a MutationObserver that re-scans dynamically injected DOM, and scans all frames including iframes.
• Provides an ops-console dashboard with severity-sorted findings, click-to-filter severity tiles, a latest-finding ticker, live search where the slash key focuses and Escape clears, one-click copy match chips, per-finding delete, and JSON or CSV export with a formula-injection sanitiser.

Who uses it and how

• Bug bounty hunters and penetration testers use it during reconnaissance, letting the extension flag secrets on each target page as they browse rather than pausing to inspect sources by hand.
• Security engineers and infosec teams reviewing web applications can deploy it across a whole team because passive scanning requires no per-user configuration and produces a per-tab red-dot alert badge when a tab has findings.
• Developers triage results directly in the dashboard, copying a matched secret from a match chip and exporting filtered findings as JSON or CSV for a report.
• OSINT analysts benefit from coverage of iframes and MutationObserver-driven re-scanning, which reaches embedded and dynamically injected content.
• Long reconnaissance sessions stay bounded by design: storage holds up to 5000 findings with FIFO eviction, writes are serialised across tabs, and custom keywords are validated at a maximum of 50.

Getting started

Install KeyFinder from the Chrome Web Store or from Firefox Add-ons, or build from source by cloning https://github.com/momenbasel/keyFinder.git, enabling Developer mode at chrome://extensions and using Load unpacked for Chrome, or loading manifest.firefox.json through about:debugging for Firefox.

How it compares

The supplied facts name no competing or paid products that KeyFinder replaces, so it stands alone in this registry rather than sitting alongside a defined set of alternatives.

When to use it — and when not to

A self-hoster has almost nothing to operate: the extension is client-side, with no database, storage service, or SMTP dependency to run. It is a poor fit for anyone who needs scheduled repository or CI pipeline scanning, because detection is passive and tied to pages a user actually visits. The 5000-finding cap with FIFO eviction means it is a triage tool rather than a durable findings archive, and the entropy analysis can flag high-entropy strings that turn out not to be secrets, so results still need human review.

git clone https://github.com/momenbasel/keyFinder.git

keyFinder/
  manifest.json            # Chrome MV3 manifest
  manifest.firefox.json    # Firefox MV3 manifest
  popup.html               # Extension popup UI
  results.html             # Findings dashboard
  js/
    background.js          # Service worker - storage and message handling
    patterns.js            # 80+ secret detection regex patterns
    content.js             # ISOLATED-world page scanner - DOM, scripts, network
    interceptor-loader.js  # ISOLATED loader - sets nonce, injects MAIN-world interceptor
    interceptor.js         # MAIN-world XHR/Fetch hooks + window global scanning
    popup.js               # Popup logic
    results.js             # Dashboard logic with filtering and export
  css/
    popup.css              # Popup styles
    results.css            # Dashboard styles
  icons/
    icon16.png
    icon48.png
    icon128.png
  scripts/
    build.sh               # Build Chrome and Firefox zip packages