Paste the code, not the keys.

What it looks for

• Keys with a known shape: AWS, GitHub, GitLab, Slack, Stripe, OpenAI, Anthropic, Google, SendGrid, Twilio, npm, Hugging Face, Shopify, Telegram
• JWTs, and whole PEM private key blocks
• The password inside a database connection string, and only the password, so the assistant still sees the host and the shape of the URL
• Authorization and Cookie headers in logs and curl commands
• Any value assigned to a name that ends in key, secret, token, password or auth, in .env, JSON, YAML, Python or shell
• Left alone on purpose: references like ${API_KEY}, placeholders like <your-key>, commit hashes, and the variable names themselves

It finds the shapes secrets usually take. It is not a guarantee: a bare random string with no known prefix and no name next to it is not caught, and a config value that happens to sit under a name ending in "key" will be masked when it did not need to be. That is why the stripped text stays on screen for you to read before you copy it, and why the same value always gets the same placeholder, so a token set in .env and sent in a header is one secret, not two.

The paid file

The free page is complete for anything under 2,000 characters. The paid file is the same tool with the limit removed and the working features added, as one file you keep. One purchase, no subscription, full refund within 14 days.

Delivered by the checkout provider immediately after payment, as a download link on the receipt and in the receipt email. Refund in full within 14 days if it does not do what this page says, no questions asked.

Plain answers

What does the assistant still see?

Everything except the secret values: the variable names, the hostnames, the ports, the shape of every URL, the whole stack trace. It can still tell you why the connection failed; it just never learns the password.

How is this different from a secret scanner in my repo?

Tools like gitleaks run at commit time on a repository and stop a leak into git. They do not run when you paste a log into a chat window, and they do not put the values back afterwards. Keyback runs at the paste, in the tab, with nothing installed, and restores the reply.

Does my text go anywhere?

No. After the page loads there are no network requests: no server, no account, no upload. You can turn off your connection and it keeps working. There is no analytics script on this site, and the fonts are served from this same address.

Will it catch everything?

No tool can promise that. Detection is pattern-based. A secret with no known prefix and no name next to it is not caught; the always-mask list in the paid file is for exactly those. Review before sending.

Who is behind this?

Tallyframe, a one-person software studio. No names or faces here, by design: the tools exist so that people can keep their own details private, and the studio keeps the same rule for itself. Everything the tool does is visible in the one file you download.

What do I get for the money?

The full file, downloaded the moment you pay, with every future version of it available from the same receipt. Personal covers one person; Team covers the people of one organisation.

What are the terms?

You buy a copy of a file for your own use (personal) or your organisation's use (team). Do not resell or redistribute it. You are responsible for reviewing what you send to any third party. The seller is not liable for what you send or fail to send. Nothing here is legal or security advice.