Scanner · runs in your browser

Get your passwords out of your config

People share their configuration.yaml on forums every day — with the API keys still in it. This finds what should not be there and writes your secrets.yaml for you.

This never leaves your browser. A tool that scans for your passwords and then uploads them would be quite the own goal. There is no server here — close the tab and it is gone.

Your configuration.yaml

Your secrets.yaml

Waiting for your config…

Nothing is uploaded. No account.

How to use what comes out

Three steps, and you only do them once:

Create a file called secrets.yaml next to your configuration.yaml, and paste the block above into it.
In your config, replace each value with the !secret line shown in the findings.
Restart Home Assistant. If something breaks, the name in the config and the name in secrets.yaml do not match — that is the only thing that ever goes wrong here.

And then never commit secrets.yaml. If your config lives in git, add it to .gitignore first. Public repositories full of working API keys are a genre at this point.

Questions people ask

Is my config sent anywhere?

No. That would be a spectacular own goal for a tool like this. The scan happens entirely in your browser — there is no server involved.

What counts as a secret?

Anything that would let someone else in or identify you: passwords, tokens, API keys, long random strings, latitude and longitude, MAC addresses and email addresses.

What do I do with the output?

Put the generated block in secrets.yaml, next to your configuration.yaml, and replace each value with !secret name as shown. Then restart.

Why does it matter if I never share my config?

Backups get uploaded, screenshots get posted, and a config in a public GitHub repo is the classic way people leak their own tokens without noticing.