Leakly — Paste Guard for AI Chats & Secrets
Privacy ·
Warns you before you paste API keys, tokens or personal IDs into an AI chat or work tool.
- Checksum-verified card, IBAN and ID matching
- Labelled placeholders, not black bars
- A fixed site list — no all_urls permission
The idea
Pasting a stack trace into an AI chat is now a normal working habit, and stack traces have connection strings in them. Leakly reads the clipboard content at the moment of paste, tells you what it found, and offers to redact it.
What it catches
- —API keys and tokens from the major cloud, payment and messaging providers
- —JWTs, bearer tokens and PEM/OpenSSH private keys — the whole block, not just the header
- —Anything labelled: API_KEY=, DB_PASSWORD=, client_secret, Authorization:
- —Connection strings — postgres://, mongodb+srv://, redis://, JDBC
- —Card numbers (Luhn-checked) and IBANs (mod-97 checked)
- —SSNs, Aadhaar numbers (Verhoeff-checked) and Indian PANs
- —High-entropy strings nothing else knows the shape of
- —Your own patterns, as regular expressions
Redaction you can still read
A redacted paste keeps its shape. Each removed value becomes a labelled placeholder — [API_KEY_1], [EMAIL_2] — so the model on the other end still understands that two mentions were the same key, and you can still follow your own paste.
Leakly declares a fixed list of sites rather than asking for access to every page you visit. It watches the chat boxes it was built for and nothing else.