Secret Paste Guard

Warn locally when pasted or submitted text looks like API keys, tokens, private keys, cards, or recovery phrases.

Secret Paste Guard warns locally when pasted, typed, or submitted text looks like a secret, so you can review risky form submissions before credentials leak. It detects common API keys, private key blocks, JWTs, GitHub tokens, AWS access keys, Slack tokens, card-like numbers that pass Luhn checks, and recovery-phrase-like text. Paste and typing warnings are non-blocking. Form-submit warnings pause the first submit so you can review before continuing. Detection runs inside your browser. Pasted, typed, and submitted field text is never stored, sent to a server, or used for analytics. The extension stores only local settings, dismissed support-banner state, and ignored hosts in Chrome extension storage. Use it for: - Reviewing sensitive admin forms before submit - Catching accidental API key pastes - Keeping local warnings enabled on risky sites - Temporarily ignoring trusted hosts when needed Password fields are never read, and fields that look like payment card inputs are skipped during full-form scans to avoid interfering with checkout flows.