Paste Guard — API Key, Token & Card Number Detector

Blocks API keys, tokens, card numbers and personal data in pasted text — checked and masked on your device.

Paste Guard catches a secret the moment you paste it, before the page can read it. API keys, tokens, card numbers and personal data are checked on your device and then blocked or masked, so a careless paste into a chat, a ticket or a form does not become a leak. What it catches • JWT tokens and complete PEM private keys • Card numbers, verified with the Luhn checksum • Email addresses, phone numbers, IBANs and passport numbers • Assignments such as api_key= and secret= How it works The paste blocker listens for the paste event on every site and matches the text against local patterns, so nothing is uploaded. Choose blocking mode to stop the paste, or masking mode to replace only the sensitive fragment — sk-…45 instead of the whole key — and keep the rest of the message. Where it works Plain inputs, text areas, rich editors such as Lexical and ProseMirror, nested iframes and shadow DOM. You can add an exception for a value or email domain you trust, and scan the visible page on demand. Privacy Everything runs locally: secret leak protection, clipboard privacy and card number detection all happen inside the browser. Settings and counters live in your browser profile, the pasted text is never stored, and no telemetry is sent. No scanner catches everything, and removing the extension deletes what it saved.