loosekeys

Find the API keys sitting in plain text on your laptop.
Shell history, forgotten .env files, AI tool and MCP configs, CLI credential stores. One command, nothing leaves your machine.

uvx loosekeys        # or: pipx run loosekeys

_{Demo run against a sandboxed home directory filled with fake keys.}

Repo scanners like gitleaks and trufflehog guard what you commit. But most leaked keys never get near a commit. They're the export OPENAI_API_KEY=sk-... you typed into your terminal eight months ago and your shell has saved ever since; the .env in a side project you forgot existed; the GitHub token you pasted into an MCP server config. loosekeys looks where those end up.

What it checks

It recognizes 30+ token formats precisely: OpenAI, Anthropic, GitHub, GitLab, AWS, Google, Stripe, Slack, Hugging Face, npm, PyPI, Groq, xAI, OpenRouter, Supabase, DigitalOcean, Twilio, SendGrid, Telegram, database URLs with passwords, private keys, and more. It also catches SOMETHING_API_KEY=... style assignments while ignoring placeholders like your_key_here, ${VAR} and changeme.

Clean up

loosekeys --redact-history

This replaces every secret in your history files with [REDACTED]:

• every other byte stays untouched, including zsh's history encoding
• it keeps a backup first (.zsh_history.loosekeys.bak, owner-only permissions)
• it writes atomically

Close other terminal sessions first: open shells hold their history in memory and can write it back.

Redacting doesn't make a leaked key safe. The report links to each provider's page for rotating the keys that ended up in history, shell config or git, and tells you what to do about the rest.

Privacy

• Nothing leaves your machine. loosekeys makes no network requests, ever.
• Secrets are never printed. Values show as sk-proj••••••Gi, in the terminal and in --json alike. The test suite asserts no full secret appears in any output.
• It's read-only unless you pass --redact-history.

Options

loosekeys ~/code ~/work      # search these folders for project files instead of your whole home
loosekeys --no-projects      # only check the well-known locations (fast)
loosekeys --json             # machine-readable, still masked; exit code 1 if anything is found

Install

pipx install loosekeys       # or: uv tool install loosekeys / pip install loosekeys

Python 3.9+ on macOS, Linux and Windows. Zero config. The only dependency is rich.

Contributing

New token formats and new tool config locations are the most useful contributions. Add the pattern in detectors.py, add a fake example in tests/fakehome.py (built at runtime, never committed as a literal), and run pytest.

License

MIT