API Key & Secret Safety Checker

API keys and secrets now turn up everywhere — CI pipelines, AI agents, mobile apps. Answer a few questions about how a key is scoped, stored and used, and get a risk rating with the fixes that matter most. You never enter the key itself.

Kind of key (shown in the report only)

Permission scope

Where it is stored

Rotation

Where it is used

Expiry

Config snippet (optional: .env file, GitHub Actions workflow, …)

Result

About this tool

This checker rates how risky the setup around an API key or secret is. Each answer adds a fixed number of points (broad permissions, hardcoding and shipping the key to clients score highest), and the total is shown as low, medium or high risk, with the findings sorted from most to least serious.

It is a rule-based first check, not an audit. Everything runs in your browser, and the page never asks for a real key. If you paste a snippet, it stays in the page and is not sent anywhere.

How it works

Scoring: permission scope 0–40, storage 0–40, rotation 0–15, usage 0–40, expiry 0–15, plus 25 for each snippet problem found (hardcoded value, secret printed to logs, known key format). 0–20 points is low risk, 21–69 medium, 70 or more high.
Kind of key does not change the score; it only appears in the copied report.
Snippet checks: (1) an assignment such as api_key = …, secret: …, token=… or password=… followed by a value of 16 or more letters, digits or - _ . / +; (2) a shell echo that prints a GitHub Actions secret, a Windows %VAR%, or a $VARIABLE whose name contains KEY, TOKEN, SECRET or PASS; (3) text shaped like well-known key formats: AWS access key IDs (AKIA…), GitHub tokens (ghp_…), Stripe live keys (sk_live_…), Slack tokens (xox…-), Google API keys (AIza…) and PEM private key headers.
The matched values are never displayed; the report only says how many were found.
Findings are sorted: danger first, then caution, then fine. Passing every check does not prove the key is safe. It means none of these specific risks were reported.

FAQ

Q. Should I paste a real key to test it?

A. No. The questions do not need one, and you should not paste live credentials into any web page. If you test a snippet, replace real values with fake ones of the same shape.

Q. A key was committed to Git. Is deleting it from the file enough?

A. No. The value stays in the repository history and may already have been copied. Revoke or rotate the key first, then remove it from the code and history if you can.

Q. How should I give an AI agent access to a service?

A. Keep the real key in the tool-execution environment and give the agent a narrowly scoped, short-lived token or a proxy endpoint. Keys placed in prompts can end up in logs, traces and model output.