🔐 AI API Key Leak Detection · Leak Radar
Paste your OpenAI / Anthropic / Google AI / Groq / Perplexity / HuggingFace / xAI API Key. After browser-side SHA-256 hashing, it is matched against a leak fingerprint database continuously collected from the public internet. Your raw key never leaves this device.
Privacy architecture:
window.crypto.subtle.digest("SHA-256") runs entirely in your browser. The server only receives the 64-character hexadecimal hash — your raw key never leaves this device. For learning and research use only.
📡 Public Fingerprint Database — Live Stats
145Verified leak fingerprints
0New in 24h
7Active sources
9Vendors affected
150Total candidates
Data updated at 2026-07-30 16:28 UTC · cron collects incrementally every 2 hours
By Vendor — Whose Keys Leak Most
| Vendor | Verified leaks | Share |
|---|---|---|
| Google AI Studio | 80 | 55.2% |
| Groq | 21 | 14.5% |
| OpenAI Project | 17 | 11.7% |
| OpenRouter | 7 | 4.8% |
| Anthropic API03 | 5 | 3.4% |
| DeepSeek | 5 | 3.4% |
| Perplexity | 4 | 2.8% |
| HuggingFace | 3 | 2.1% |
By Source — Where They Were Found
| Source | Verified leaks | Share |
|---|---|---|
| github_code_search | 42 | 29.0% |
| huggingface | 39 | 26.9% |
| pypi | 37 | 25.5% |
| postman | 12 | 8.3% |
| deploy_js | 9 | 6.2% |
| github_gist | 4 | 2.8% |
How This Project Works
📊 Collection: Continuous passive scanning and deduplication from 10 public sources (public code repositories, public package indexes, public deployment artifacts, etc.). Only publicly accessible content is fingerprinted.
🔒 Storage: The fingerprint database stores only hashes and source metadata — raw keys never enter the main table. Hashing is done locally in your browser; your raw key never leaves this device.
🔬 Purpose: For learning and research only — helps developers quickly check whether their keys have appeared on the public internet. No validity verification is performed; no upstream requests are made.
🔒 Storage: The fingerprint database stores only hashes and source metadata — raw keys never enter the main table. Hashing is done locally in your browser; your raw key never leaves this device.
🔬 Purpose: For learning and research only — helps developers quickly check whether their keys have appeared on the public internet. No validity verification is performed; no upstream requests are made.
📘 Full methodology + privacy architecture + source details →