Checker
Is my Stripe key leaked?
Paste the deployed URL. LeakWatch reads the HTML and the scripts that page loads. A Stripe live secret in that code is a leak. A test secret is not meant for a browser either. A publishable key is public configuration.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
Live secret
A secret key that starts with the live prefix can move money. Treat it as compromised, rotate it in Stripe, and load the replacement only on a server.
Test secret
A test secret in the bundle can be copied by anyone who loads the page and used against your Stripe test data. It does not belong in frontend code.
Publishable key
The publishable key is designed to be in the browser. It is not reported as a leaked secret. LeakWatch does not call Stripe with any key it finds.
Questions
- Do you charge a card or call the Stripe API?
- No. The check only reads the public page and its scripts. A found secret is not used.
- Is the full key stored?
- No. A paid report can show the first four and last four characters. The middle is discarded.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.