Skip to main content NumanX
✦ Security Utility

Google Sheets Secret Scanner

Proactively scan your Google Spreadsheets for exposed API keys, passwords, and tokens.

Make sure to share the sheet with your Service Account.
Why Use This Tool

Benefits of Using Sheet Secret Scanner

🛡️

Proactive Security

Identify exposed API keys and passwords before they are found by malicious actors or automated bots.

Instant Scanning

Uses optimized regular expressions to scan thousands of cells in seconds without lagging your browser.

🔒

Privacy Preserving

Sheet data is processed entirely in memory and immediately discarded. Your data is never logged or stored.

🤖

Wide Detection

Automatically identifies AWS keys, Google Cloud credentials, Stripe secrets, and generic token patterns.

Quick Start

How to Use This Tool

1

Share Document

Ensure the target Google Sheet is shared with the specific Service Account email provided in the tool.

2

Find ID

Locate the long alphanumeric Sheet ID in your spreadsheet URL (between /d/ and /edit).

3

Run Scanner

Paste the ID into the input field and click "Start Scan" to initiate the deep inspection.

4

Review Results

Check the output list. If secrets are found, immediately rotate the compromised keys and delete them from the sheet.

Applications

Common Use Cases

🏢

Corporate Auditing

Regularly scan shared company spreadsheets to ensure employees haven't accidentally pasted production passwords.

💻

Developer Handoff

Check configuration spreadsheets before sharing them with external contractors or open-sourcing projects.

🚨

Incident Response

Quickly locate the source of a suspected credentials leak across multiple departmental Google Sheets.

Related Guides

Comparisons

M Muhammad Numan Usmani

Muhammad Numan Usmani

Founder & Developer at NumanX Studio

Frequently Asked Questions

This tool uses the Google Service Account configured in the backend environment variables. It can read sheets that have been shared with your service account email.
The scanner currently detects AWS Keys, Google API Keys, Stripe Secrets, RSA Private Keys, and generic token/password patterns.
No. The spreadsheet data is briefly loaded into memory to perform the regular expression scans, and then immediately discarded. No data is logged or persisted.