| 1Password Backup | Detects backup files containing encrypted password vault data from the 1Password application |
| Advanced RAR Password Recovery | Detects files or data related to software used for recovering forgotten passwords from password-protected RAR archives |
| Amazon Access Key ID | Detects Amazon access key ID |
| Amazon Manager ID | Detects Amazon manager ID |
| Amazon Marketplace Token | Detects Amazon marketplace token |
| Amazon Resource Name | Detects Amazon resource name |
| Amazon Secret Access Key | Detects Amazon secret access key |
| Amazon Session Token | Detects Amazon session token |
| American Bankers Association Number (ABA) | Detects American Bankers Association number (ABA) |
| API Key Reference | Detects API key reference |
| Apache Basic Authentication File | Detects a configuration file (typically .htpasswd) containing username and password credentials for HTTP basic authentication on Apache web servers |
| Australian Business Number | Detects Australian business number |
| Australian Tax File Number | Detects Australian tax file number |
| Authentication Header | Detects authentication header |
| Azure DocumentDB Connection String | Detects Azure documentDB connection string |
| Azure IoT Connection String | Detects Azure IoT connection string |
| Azure Redis Cache Connection String | Detects Azure Redis cache connection string |
| Azure Service Bus Connection String | Detects Azure service bus connection string |
| Azure SQL Connection String | Detects Azure SQL connection string |
| Azure Storage Connection String | Detects Azure storage connection string |
| Azure VM Resource Manager Connection String | Detects Azure VM resource manager connection string |
| Backup File | Detects a copy of data stored separately from the original source to protect against data loss or system failure |
| Bank Account Number | Detects bank account number |
| Bank Branch Identifier | Detects bank branch identifier |
| Bank Routing Transit Number (RTN) | Detects bank routing transit number (RTN) |
| Base64 Encoding | Detects base64 encoding |
| BASH History | Detects a file with the command history of user interactions in the Bash shell environment on Unix-like systems |
| Biometric Data | Detects biometric data such as fingerprints or facial recognition |
| Bitcoin Address | Detects a bitcoin address |
| Bitcoin Private Key | Finds strings that match the format of a bitcoin private key starting with 5, K, or L |
| BitLocker Recovery Key | Detects bitlocker recovery key |
| Bitser Password Database | Detects a password database file created by Bitser archive software with encrypted authentication credentials |
| Brazilian - Company Registration Number (CNPJ) | Detects Brazilian company registration number (CNPJ) |
| Brazilian - Person Registration Information (CPF) | Detects Brazilian person registration information (CPF) |
| Brazilian - Person Registration Number (CPF) | Detects Brazilian person registration number (CPF) |
| Business and Technical Drawing | Detects files containing professional diagrams, blueprints, schematics, or technical illustrations used in engineering or business contexts |
| Calendar Event | Detects records with details about scheduled appointments, meetings, or reminders stored in calendar applications |
| California - Resale License Number | Detects California resale license number |
| Canada - Social Insurance Number | Detects Canada social insurance number |
| Canadian - Passport Number | Detects Canadian passport number |
| Certificate | Detects documents using cryptographic signatures to verify the identity of an entity or to secure communications |
| Certificate Chain | Detects a sequence of linked digital certificates that establishes a trust path from a root certificate authority to an end-entity certificate |
| Certificate Revocation List | Detects a list of digital certificates that have been revoked by a certificate authority before their expiration date |
| Certificate Signing Request | Detects a message sent to a certificate authority requesting the issuance of a digital certificate for a specific public key |
| China Resident Identity Card Number | Detects China resident identity card number |
| Compressed Disk Image | Detects a file containing a compressed copy of an entire disk or partition, including its file system and data structure |
| Compressed File | Detects a file that has been reduced in size using compression algorithms to save storage space or transmission time |
| Configuration File | Detects a file containing settings and parameters that control the behavior and operation of software apps or systems |
| Contract Agreement | Detects contract agreement |
| Court Order | Detects court order |
| Credit Card | Uses image recognition to find credit card shapes and visible numbers in photos |
| Credit Card (Global) | Detects data containing credit card information such as numbers, expiration dates, and cardholder details from international payment systems |
| Dash Pay Address | Detects dash pay address |
| Database Backup File | Detects a file containing a complete or partial copy of database contents and structure for recovery and restoration purposes |
| Database/API Credentials | Detects database/API credentials |
| Date of Birth | Detects date of birth |
| Date of Death | Detects date of death |
| dBASE Database | Detects a database file created by dBASE software, using the .dbf format commonly used for storing structured tabular data |
| Department of Defense Form | Detects department of defense form |
| Diploma Picture | Detects diploma picture in images |
| Driving License | Detects driving license in images |
| Driving License Information | Detects driving license information |
| Driving License Information List | Detects a collection of data containing driver's license details such as license numbers, personal information, and driving privileges |
| Driving License Number | Detects driving license number |
| Drug Enforcement Administration Number | Detects drug enforcement administration number |
| Educational Information | Detects educational information |
| Email Address | Detects email address |
| Employee Information List | Detects a dataset containing personnel records including employee names, contact details, job titles, and other workplace-related information |
| Employer Identification Number | Detects employer identification number |
| Encrypted Data | Finds information that has been transformed using cryptographic algorithms to prevent unauthorized access or reading |
| Encrypted Email Archive | Detects a collection of email messages and attachments that have been encrypted and stored for long-term preservation and security |
| Ethnicity or Race | Identify mentions of ethnicity or race |
| Ethereum Address | Detects ethereum address |
| Ethereum Transaction Hash | Detects ethereum transaction hash |
| European Patent Number | Detects European patent number |
| Facebook Access Token | Detects Facebook access token |
| File Crypt Password File | Detects a file containing encrypted passwords or credentials used by file encryption software to secure and decrypt protected files |
| GIT Configuration | Detects a configuration file containing Git version control system settings, such as user information, repository preferences, and branch configurations |
| GitHub Access Token | Detects GitHub access token |
| GitHub Personal Token | Detects GitHub personal token |
| GitHub Recovery Codes | Detects GitHub recovery code |
| GNU Privacy Guard Public Keyring | Detects GNU privacy guard public keyring |
| Google API Key | Detects Google API key |
| Google Captcha Key | Detects Google captcha key |
| Google OAuth ID | Detects Google OAuth ID |
| Government Purchase Card (SmartPay) | Looks for text referencing the GSA SmartPay program such as "GSA SmartPay" and mentions of potential misuse to spot government purchase card details |
| Heroku API Key | Detects Heroku API key |
| Heroku Encoded API Key | Detects Heroku encoded API key |
| hMailServer Password Hash | Detects hmailserver password hash |
| Hong Kong Driving License | Detects Hong Kong driving license |
| Hong Kong Identification Number | Detects Hong Kong identification number |
| Hong Kong Passport Number | Detects Hong Kong passport number |
| HTTP Archive | Detects a file format (.har) that records web browser interactions including HTTP requests, responses, and performance data for debugging and analysis |
| Identification Card | Detects identification card in images |
| Individual Taxpayer Identification Number | Detects individual taxpayer identification number |
| International Bank Account Number | Detects international bank account number |
| International Machine-Readable Passport | Identifies strings that follow the machine-readable passport format used on international passports |
| International Mobile Equipment Identity (IMEI) | Detects international mobile equipment identity (IMEI) |
| International Securities Identifying Number (ISIN) | Detects international securities identifying number (ISIN) |
| IP Address | Detects IP address |
| IT Assets Information List | Finds a dataset with inventory details of information technology equipment such as computers, servers, software licenses, and network devices |
| Java KeyStore | Detects a secure repository file that stores cryptographic keys, certificates, and trusted certificate entries for Java applications |
| JWT Token | Detects JWT token |
| KeePass Password Database | Detects an encrypted database file created by KeePass Password Manager containing stored passwords and secure notes |
| LastPass Passwords | Detects exported password data from the LastPass Password Manager containing login credentials and associated website information |
| License Information | Detects license information in images |
| License Plate | Detects license plate in images |
| LinkedIn Secret Key | Detects LinkedIn secret key |
| Linux Password File | Detects Linux password file |
| Litecoin Address | Detects litecoin address |
| MAC Address | Detects MAC address |
| MailChimp API Key | Detects MailChimp API key |
| MD5 Hash | Detects MD5 hash |
| Medical Digital Image | Detects CT scan images using computer vision models trained on common medical imaging patterns |
| Medical File | Finds documents or datasets containing patient health information, medical records, diagnoses, treatments, or other healthcare-related data |
| Medical Information | Uses generative AI to spot medical terms—like diagnoses or prescriptions—that reveal protected health information |
| Medical Record Number | Detects medical record number |
| Medicare Beneficiary Identifier | Detects Medicare beneficiary identifier |
| Medicare Information | Detects data relevant to Medicare, the Australian health provider |
| Meeting Link | Detects meeting link |
| Mexico - Social Security Number (NSS) | Detects Mexican social security number (NSS) |
| Mexico - Unique Population Registry Code (CURP) | Detects Mexican unique population registry code (CURP) |
| Microsoft Access Database | Detects a database file created by Microsoft Access containing structured data tables, queries, forms, and reports in .mdb or .accdb format |
| Microsoft Compiled HTML Help | Detects a compressed help file format (.chm) used by Windows applications to provide documentation and user assistance |
| Microsoft Entra Client Secret | Detects Microsoft Entra client secret |
| Microsoft Exchange Database | Detects a database file used by Microsoft Exchange Server to store email messages, calendars, contacts, and other mailbox data |
| Monero Address | Detects Monero address |
| Mozilla Autocomplete History | Detects a file storing previously entered form data and search terms to enable automatic completion in Mozilla Firefox browser |
| Mozilla Bookmark Backup | Detects a backup file containing saved website bookmarks and folder structures from Mozilla Firefox browser |
| Mozilla Certificate Settings | Detects configuration data storing SSL/TLS certificate preferences and security certificate information for Mozilla applications |
| Mozilla Cookies Information | Detects data files containing website cookies stored by Mozilla Firefox for maintaining session state and user preferences |
| Mozilla Passwords | Detects stored login credentials and authentication information saved by the Mozilla Firefox browser for automatic form filling |
| Mozilla Personal Dictionary | Detects a custom dictionary file containing user-added words for spell-checking in Mozilla applications |
| Mozilla Preferences Backup | Detects a backup file containing user configuration settings and customizations for Mozilla Firefox browser |
| Mozilla Security Settings | Finds configuration data containing security preferences, privacy settings, and protection options for Mozilla applications |
| Mozilla Stored Session | Detects data files containing information about open tabs, windows, and browsing session state in Mozilla Firefox for session restoration |
| MySQL Challenge-Response Authentication | Detects MySQL challenge-response authentication |
| MySQL Password Hash 5.x/4.1 | Detects MySQL password hash 5.x/4.1 |
| National Health Service Number (UK) | Detects national health service number (UK) |
| Network Capture File | Detects a file containing captured network traffic data and packet information for network analysis and troubleshooting purposes |
| North American - Financial Security (CUSIP) | Detects North American financial security (CUSIP) |
| NTHASH Hash (FreeBSD) | Detects NTHASH hash (FreeBSD) |
| NTLM Hash | Detects NTLM hash |
| OAuth Token | Detects OAuth token |
| Ontario Health Insurance Plan Number | Detects Ontario health insurance plan number |
| OpenSSH Private Key | Detects a cryptographic private key file used for SSH authentication and secure remote access to servers and systems |
| Outlook Address Book | Detects a file containing contact information, email addresses, and personal details stored in Microsoft Outlook's address book |
| Outlook Data Files | Detects personal folder files (.pst or .ost) containing email messages, calendar items, contacts, and other Outlook data |
| Outlook Invitation Metadata | Data containing details about meeting invitations such as attendees, scheduling information, and event properties from Outlook |
| Passport | Uses object detection to identify the distinctive look of a passport booklet |
| Passport (Global) | Detects data containing passport information including passport numbers, personal identification details, and travel document data from international sources |
| Password Agent File | Detects a file created by Password Agent software containing encrypted password storage and management data |
| Password Protected File | Detects any file that requires a password or authentication credentials to access or open its contents |
| Password Repository File | Detects a secure file containing multiple stored passwords and authentication credentials in an organized database format |
| Password Walconst Database | Detects a password database file created by Walconst containing encrypted login credentials |
| Patient Information | Detects patient information |
| Patient Information List | Finds a dataset containing medical patient records including personal details, medical history, and healthcare information |
| Payment Information List | Detects a collection of data containing financial payment details such as credit card numbers, bank accounts, and transaction information |
| PayPal/Braintree Access Token | Detects Paypal/Braintree access token |
| PDF/Acrobat Password Hash | Detects PDF/Acrobat password hash |
| Personal Information List | Detects a dataset containing personally identifiable information such as names, addresses, phone numbers, and other private details |
| Personal Name | Employs AI language models to pick out first or last names that appear within the text |
| PGP Clear Message | Detects an unencrypted text message that has been digitally signed using PGP (Pretty Good Privacy) cryptography for authentication purposes |
| PGP Encrypted Message | Detects a message that has been encrypted using PGP (Pretty Good Privacy) cryptography to ensure confidential communication |
| PGP Private Key | Detects a cryptographic private key used in PGP encryption systems for decrypting messages and creating digital signatures |
| PGP Public Key | Detects a cryptographic public key used in PGP systems for encrypting messages and verifying digital signatures |
| PGP Signature | Detects a digital signature created using PGP cryptography to verify the authenticity and integrity of a message or file |
| Phone Number | Detects data containing telephone numbers and associated contact information in various formats and regional standards |
| Physical Traits | Spot descriptions of physical characteristics like height or eye color |
| PIN Code | Detects a PIN code |
| Police Report | Detects police report |
| Post Office Boxes | Find mentions of PO box mailing addresses |
| Postal Address | Detect full postal addresses including street, city, state and postal code |
| PostgreSQL Password File | Detects a configuration file containing authentication credentials and connection passwords for PostgreSQL database access |
| Printed Circuit Boards Document | Detects technical documentation containing PCB designs, schematics, layouts, and manufacturing specifications for electronic circuits |
| Printed Ticket | Detects printed ticket in images |
| Private Key | Looks for blocks beginning with "BEGIN PRIVATE KEY" to spot cryptographic private keys |
| Private Key and Certificate | Detects a combined file containing both a cryptographic private key and its corresponding digital certificate for secure communication |
| Product Key Information List | Finds a dataset containing software license keys, product activation codes, and associated software registration information |
| Public Key | Detects a cryptographic key that can be freely shared and used for encrypting data or verifying digital signatures |
| PuTTy Private Key | Detects a private key file format (.ppk) used by PuTTy SSH client software for secure remote server authentication |
| Region Identifiers | Detect geographic region names, such as cities or states |
| Relationship Status | Detects relationship status |
| Remote Desktop Connection | Detects a file containing connection settings and credentials for accessing remote computers via Remote Desktop Protocol (RDP) |
| Ripple Address | Detects ripple address |
| RSA Private Key | Detects a cryptographic private key that uses the RSA algorithm for decrypting data, creating digital signatures, and securing authentication |
| RSA Public Key | Detects a cryptographic public key that uses the RSA algorithm for encrypting data and verifying digital signatures from the corresponding private key |
| S/MIME Signature | Detects a digital signature using the S/MIME (Secure/Multipurpose Internet Mail Extensions) standard to authenticate and verify email message integrity |
| School Picture | Detects school picture in images |
| Scripting/Executable File | Detects a file containing executable code or scripts that can be run to perform automated tasks or system operations |
| Shipping Tracking Number | Detects shipping tracking number |
| Singapore National Registration Identity Card | Detects Singapore national registration identity card |
| Slack API Key | Detects Slack API key |
| SMTP Message Transaction | Finds data representing email transmission records including sender, recipient, and delivery information from SMTP mail server communications |
| Social Relationships | Identify references to family or other social connections |
| Social Security Information | Matches phrases from US Social Security documents like "THIS NUMBER HAS BEEN ESTABLISHED FOR" to detect references to a social security number |
| Social Security Information List | Detects a dataset containing social security numbers and related personal identification information for individuals |
| South African Identification Number | Detects South African identification number |
| SQL Connection String | Detects SQL connection string |
| SQLite Database | Detects a file-based database in SQLite format that stores structured data in tables without requiring a a separate server |
| Square Secret Token | Detects a square secret token |
| SSH Private Key | Detects a cryptographic private key used for SSH (secure shell) authentication to establish secure remote connections to servers |
| Street Address | Detect street addresses, such as house numbers and street names |
| Stripe API Key | Detects stripe API key |
| Student Aid Report | Detects student aid report |
| Student Picture | Detects student picture in images |
| SWIFT/BIC Number | Detects SWIFT/BIC number |
| Switzerland - Insurance Number | Detects Switzerland insurance number |
| Teacher Picture | Detects teacher picture in images |
| Teen Picture | Detects teen picture in images |
| Tencent API Key | Detects Tencent API key |
| Trusted Platform Module Password File | Detects a file containing authentication credentials and security keys managed by TPM hardware for system security and encryption |
| Twilio Account SID | Detects Twilio account SID |
| Twilio API Key | Detects Twilio API key |
| Twilio App SID | Detects Twilio app SID |
| Uniform Resource Name | Detects uniform resource name |
| Unique Taxpayer Reference (UTR) | Detects unique taxpayer reference (UTR) |
| United Kingdom - Driving License | Detects United Kingdom driving license |
| United Kingdom - National Insurance Number | Detects United Kingdom national insurance number |
| United Kingdom - Passport Number | Detects United Kingdom passport number |
| United States - Passport Number | Detects United States passport number |
| United States - Social Security Number | Detects US social security numbers using formatting rules that exclude invalid sequences |
| United States - Social Security Number (Non-Format) | Detects United States social security number (non-format) |
| United States - Vehicle Identification Number | Detects United States vehicle identification number |
| URI Connection String | Detects URI connection string |
| URI Parameter Credentials | Detects URI parameter credentials |
| User Credential Information List | Finds a dataset containing usernames, passwords, and authentication information for various user accounts and systems |
| User Credentials | Detects user credentials |
| WebStorm Encrypted Key | Detects an encrypted key file used by WebStorm for secure authentication and license management purposes |
| Windows Password List | Finds a collection of Windows user account passwords and authentication credentials stored in various formats |
| Windows Password Reset Disk File | Detects a special disk file created to reset forgotten Windows user account passwords without losing data access |
| Windows SAM File | Detects the Security Account Manager database file that stores Windows user account information and password hashes for local authentication |
| WordPress Config File | Detects a configuration file (wp-config.php) containing WordPress website settings, database connections, and security keys |
| WordPress/PHPass Password Hash | Detects WordPress/PHPass password hash |
| Zix Encrypted Message | Detects an encrypted email message processed through Zix email encryption service |