KeyFinder

KeyFinder

Passive API key and secret discovery for Chrome, Firefox, Edge, and Safari

KeyFinder is a browser extension for Chrome, Firefox, Edge, and Safari that passively scans every page you visit for leaked API keys, tokens, secrets, and credentials. It runs silently in the background with zero configuration required.

Supported Browsers

Browser	Status	Manifest
Chrome	✅ Supported	manifest.json
Firefox	✅ Supported	manifest.firefox.json
Edge	✅ Supported	manifest.edge.json
Safari (macOS/iOS)	✅ Supported	manifest.safari.json
Edge Mobile	❌ Not Supported	N/A
Safari iOS (older)	⚠️ See notes	manifest.safari.json

What It Detects

KeyFinder ships with (80+ detection patterns) covering secrets from:

Category	Providers
Cloud	AWS (Access Keys, Secret Keys, Session Tokens, Cognito), Google Cloud (API Keys, OAuth, Service Accounts), Azure (Storage Keys, SAS Tokens, Connection Strings)
Source Control	GitHub (PATs, OAuth, Fine-grained tokens), GitLab (PATs, Pipelines, Runner tokens), Bitbucket
Payments	Stripe (Secret, Publishable, Restricted, Webhook), PayPal Brains, Square
Communication	Slack (Bot, User, App tokens, Webhooks), Discord (Bot tokens, Webhooks), Telegram, Twilio, SendGrid
AI / ML	OpenAI, Anthropic, HuggingFace, Replicate
Databases	MongoDB, PostgreSQL, MySQL, Redis connection strings
SaaS	Shopify, Sendy, New Relic, Linear, Notion, Algolia, Mapbox
Infrastructure	HashiCorp Vault, Terraform, Docker Hub, NPM, Cloudflare, DigitalOcean, Grafana
Crypto	RSA, EC, OpenSSH, DSA private keys
Generic	JWTs, Bearer tokens, Basic Auth, API key assignments, credential URLs, high-entropy strings

Installation

Chrome

• Install from Chrome Web Store

Firefox

• Install from Firefox Add-ons

Edge

1. Clone the repository: git clone https://github.com/earacicotjr-star/keyFinder-1.git
2. Go to edge://extensions
3. Enable Developer mode
4. Click Load unpacked and select the keyFinder-1 folder
5. Use manifest.edge.json as the manifest

Safari (macOS)

1. Clone the repository: git clone https://github.com/earacicotjr-star/keyFinder-1.git
2. Open Safari > Preferences > Advanced > Show Develop menu
3. Develop > Safari Extensions Settings
4. Click + and select the keyFinder-1 folder
5. Enable the extension in Safari preferences

Safari (iOS)

1. Open Safari on your iOS device
2. Go to Settings > Safari > Extensions
3. Enable KeyFinder

Usage

1. Install the extension
2. Browse the web normally — KeyFinder scans every page in the background
3. Click the extension icon to see stats and manage keywords
4. Click View Findings to open the full results dashboard
5. Filter by severity, provider, or type
6. Export findings as JSON or CSV for reporting

Architecture

keyFinder/
  manifest.json              # Chrome MV3 manifest
  manifest.firefox.json     # Firefox MV3 manifest
  manifest.edge.json        # Edge MV3 manifest
  manifest.safari.json     # Safari Web Extension manifest
  popup.html                # Extension popup UI
  results.html              # Findings dashboard
  js/
    background.js           # Service worker - storage and message handling
    patterns.js             # 80+ secret detection regex patterns
    content.js              # Page scanner - DOM, scripts, network interception
    interceptor.js         # XHR/Fetch hooking and window global scanning
    popup.js                # Popup logic
    results.js             # Dashboard logic with filtering and export
  css/
    popup.css               # Popup styles
    results.css            # Dashboard styles
  icons/
    icon16.png
    icon48.png
    icon128.png
  scripts/
    build.sh               # Build Chrome and Firefox zip packages

Disclaimer

This tool is intended for security research and authorized testing only. Use it to identify leaked secrets on your own applications or ones you have permission to test.

License

MIT License - See LICENSE file for details.