OPEN SOURCE · SECURITY RESEARCH
StripeInspector
A leaked Stripe key isn't just a key. It's the customer list, the charge history and the card last-4s behind it. Paste one below and see exactly how much it exposes.
STRIPE API KEY
The key is sent to this site's edge worker, used only to query the Stripe API for this scan, and never stored or logged. Prefer to trust nothing? Run it entirely on your own machine with the CLI below.
What it finds
17 modules walk every corner of the account a key can reach. A permission scanner probes 34 endpoints to map exactly what the key is allowed to do, and flags exposed PII along the way.
accountbalancecustomerschargespayment_intentsproductspayoutssubscriptionsinvoiceswebhookseventsconnecteddisputesrefundsbalance_transactionscouponspermission_scan
Keys it reads
It identifies the key type on sight and scores the blast radius.
| PREFIX | TYPE | RISK |
|---|---|---|
sk_test_ | Secret, test mode | LOW |
sk_live_ | Secret, live mode | HIGH |
rk_test_ | Restricted, test mode | LOW |
rk_live_ | Restricted, live mode | MEDIUM |
Run it on your own machine
The same tool ships as an open-source Python package — no third-party edge in the path, the key never leaves your terminal.
pip install stripe-inspector# inspect a key — every module
stripe-inspector inspect sk_test_xxxx
# JSON, HTML report, deep scan, or pick modules
stripe-inspector inspect sk_test_xxxx --output json
stripe-inspector inspect sk_test_xxxx --report findings.html
stripe-inspector inspect sk_test_xxxx --deep
stripe-inspector inspect sk_test_xxxx --modules account,customers,chargesOr a local web UI
Prefer a browser but want it fully local? The package serves the same UI on your own machine.
stripe-inspector serve # http://localhost:8000