HTML Comment Extractor - Find Hidden Notes in a URL

HTML Comment Extractor — find hidden notes & leaks in any URL

Send a URL, get every HTML comment left in the page source, with the ones that match sensitive patterns flagged as suspicious.

You give it	You get back	You pay (Free plan)
One URL or a list of up to 25	Per page: comment count, each comment text and length, suspicious flag and count	$0.001 per page

Pay per result only: no subscription, no start fee. An unreachable URL returns {ok:false, error} and is not charged. Paid Apify plans get Store discounts on the price above.

Example: try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "url": "https://en.wikipedia.org/wiki/HTML",
  "urls": [
    "https://en.wikipedia.org/wiki/HTML",
    "https://www.w3.org/"
  ]
}

Real output from that exact input (run on 2026-09-24; long arrays shortened to a few entries and long text cut for display):

[
  {
    "ok": true,
    "url": "https://en.wikipedia.org/wiki/HTML",
    "status": 200,
    "commentCount": 11,
    "comments": [
      {
        "text": "CentralNotice",
        "length": 13,
        "suspicious": false
      },
      {
        "text": "Forms and input tags introduced",
        "length": 31,
        "suspicious": false
      }
    ],
    "suspiciousCount": 0
  }
]

Extract the HTML comments (<!-- ... -->) from a page and flag sensitive ones — TODO/FIXME/HACK notes, passwords, API keys, tokens, internal/staging/debug references, and "remove before deploy" markers. Common framework/build markers are filtered out unless they look suspicious. Built for security review, red-team recon, and code-hygiene audits. Single URL or bulk.

$0.001 per page. Failed fetches are recorded free.

What you get

• comments — each { text, length, suspicious } (text capped at 2000 chars).
• suspiciousCount — comments matching sensitive patterns.
• commentCount — total kept comments (empty and framework-only markers filtered).
• Fail-soft: an unreachable URL returns {ok:false, error} and is never charged.

Input

{ "url": "https://www.wikipedia.org", "urls": ["https://example.com"], "maxUrls": 25 }

Output (real run, 2026-08-07)

{
  "ok": true,
  "url": "https://www.wikipedia.org/",
  "status": 200,
  "commentCount": 45,
  "suspiciousCount": 0,
  "comments": [
    { "text": "#1. en.wikipedia.org - 1,502,942,000 views/day", "length": 46, "suspicious": false }
  ]
}

A comment like <!-- TODO: remove test API key before launch --> comes back with suspicious: true.

Pricing — $0.001 per page

Priced at roughly 5× our measured compute cost per page. No directly comparable HTML-comment extractor was found on the Apify Store on 2026-08-07 (the "comments" listings are social-media comment scrapers, a different problem), so there is no competitor price to quote.

Limits (honest ones)

• Reads the server HTML; comments injected by JavaScript after load are not seen.
• suspicious is a keyword/pattern heuristic — it flags candidates for review, it is not a verdict that a secret is real.
• Comment text is truncated to 2000 characters per comment.
• maxUrls capped at 100 per run.

FAQ

• What counts as "suspicious"? Comments matching patterns like TODO/FIXME, password/secret/api-key/token, internal/staging/debug, localhost, or "remove before deploy".
• Why are some comments missing? Empty comments and pure framework/build markers (e.g. IE conditionals, ad markers) are filtered unless they look suspicious.
• Does it run JavaScript? No — server HTML only.
• What about a dead URL? You get an {ok:false, error} record, uncharged.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~webpage-comment-extractor/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"url":"https://www.wikipedia.org"}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com).

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/webpage-comment-extractor
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~webpage-comment-extractor/run-sync-get-dataset-items
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.

Who uses it

• Bug bounty hunters scanning page source for TODOs, staging URLs and API keys left in comments
• Security teams checking production pages for "remove before deploy" notes after a release
• Code reviewers auditing a site's shipped HTML for internal comments
• Red teams collecting internal hostnames mentioned in comments during recon
• Web agencies cleaning debug comments from client sites before handover

Changelog

• 2026-11-01: Page text only: the "Try it" block is now headed Example. Code, output and price are unchanged.
• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.