🔐 AI API Key Leak Detection · Leak Radar
Paste your OpenAI / Anthropic / Google AI / Groq / Perplexity / HuggingFace / xAI API Key. After browser-side SHA-256 hashing, it is matched against a leak fingerprint database continuously collected from the public internet. Your raw key never leaves this device.
Privacy architecture:
window.crypto.subtle.digest("SHA-256") runs entirely in your browser. The server only receives the 64-character hexadecimal hash — your raw key never leaves this device. For learning and research use only.
📡 Public Fingerprint Database — Live Stats
209Verified leak fingerprints
1New in 24h
8Active sources
10Vendors affected
214Total candidates
Data updated at 2026-10-29 08:34 UTC · cron collects incrementally every 2 hours
By Vendor — Whose Keys Leak Most
| Vendor | Verified leaks | Share |
|---|---|---|
| Google AI Studio | 118 | 56.5% |
| Groq | 31 | 14.8% |
| OpenAI Project | 25 | 12.0% |
| OpenRouter | 9 | 4.3% |
| Anthropic API03 | 6 | 2.9% |
| HuggingFace | 6 | 2.9% |
| DeepSeek | 5 | 2.4% |
| Perplexity | 5 | 2.4% |
By Source — Where They Were Found
| Source | Verified leaks | Share |
|---|---|---|
| github_code_search | 60 | 28.7% |
| huggingface | 56 | 26.8% |
| pypi | 51 | 24.4% |
| postman | 17 | 8.1% |
| deploy_js | 14 | 6.7% |
| npm | 5 | 2.4% |
How This Project Works
📊 Collection: Continuous passive scanning and deduplication from 10 public sources (public code repositories, public package indexes, public deployment artifacts, etc.). Only publicly accessible content is fingerprinted.
🔒 Storage: The fingerprint database stores only hashes and source metadata — raw keys never enter the main table. Hashing is done locally in your browser; your raw key never leaves this device.
🔬 Purpose: For learning and research only — helps developers quickly check whether their keys have appeared on the public internet. No validity verification is performed; no upstream requests are made.
🔒 Storage: The fingerprint database stores only hashes and source metadata — raw keys never enter the main table. Hashing is done locally in your browser; your raw key never leaves this device.
🔬 Purpose: For learning and research only — helps developers quickly check whether their keys have appeared on the public internet. No validity verification is performed; no upstream requests are made.
📘 Full methodology + privacy architecture + source details →