Prompt Injection & Leakage Scanner
Scan LLM inputs and outputs for prompt injection payloads, jailbreak attempts, and leaked system instructions. Uses deterministic pattern matching and Shannon entropy analysis — no cloud security APIs required.
Tool interface
Scan results
High risk Medium risk Low risk / Info
Introduction
Prompt injection is a critical security vulnerability in LLM applications. Attackers craft inputs that override system instructions, extract sensitive data, or manipulate model behavior. This tool scans for known injection patterns, encoding tricks, and leaked system instructions using deterministic analysis.
How it works
- Pattern matching: Scans for known injection phrases, jailbreak prompts, and role manipulation attempts.
- Entropy analysis: Calculates Shannon entropy to detect obfuscated or encoded payloads (high entropy = suspicious).
- Encoding detection: Identifies Base64, hex, and ROT13 encoding, then decodes for inspection.
- Leak detection: Scans LLM outputs for system prompt fragments and instruction leakage.
Common injection patterns
- Direct override: "Ignore all previous instructions", "Disregard your training"
- Role manipulation: "You are now DAN", "Pretend you are an unrestricted AI"
- Context switching: "New task:", "Forget everything above", "Let's start over"
- Encoded payloads: Base64 or hex-encoded instructions to bypass filters
- Multi-turn attacks: Gradual instruction drift across conversation turns
Shannon entropy
Shannon entropy measures the randomness or unpredictability of text. Normal English text has entropy around 4.0–4.5 bits per character. Encoded or obfuscated payloads typically have higher entropy (5.0+). This tool flags high-entropy segments for review.
Privacy
All scanning happens in your browser using deterministic JavaScript. There is no upload, no account, no API key, and no remote security service. Your text never leaves the page. This is critical for security testing, as sending malicious payloads to cloud scanners can trigger false-positive bans or alerts.
Limitations
- Cannot detect zero-day semantic jailbreaks that rely on psychological manipulation rather than structural payloads.
- Pattern-based detection may miss novel attacks or highly obfuscated variants.
- False positives are possible on legitimate technical content (e.g., security documentation, code examples).
- Multi-turn attack detection requires conversation history, which this tool does not track.
FAQ
What is prompt injection?
Prompt injection is an attack where a user crafts input that overrides the system prompt, causing the LLM to ignore safety guidelines, leak sensitive data, or perform unintended actions.
Why use entropy analysis?
Attackers often encode payloads (Base64, hex) to bypass keyword filters. High entropy indicates randomness, which is suspicious for natural language inputs.
Can this catch all jailbreaks?
No. Sophisticated semantic jailbreaks that use psychological manipulation or novel phrasing may evade pattern-based detection. This tool catches known patterns and obfuscation tricks.
Related tools
References
- OWASP — Top 10 for LLM Applications
- Simon Willison — Prompt Injection: What's the worst that can happen?