Identify API key types and get ready-to-run validation commands. Supports 455+ services. No server processing, complete privacy.
100% Client-Side
Keys never leave your browser
455+ Patterns
AWS, GitHub, Stripe, Slack & more
Ready Commands
Copy & run validation commands
Risk Assessment
Understand potential impact
AWS_SECRET_ACCESS_KEY=xxxMissing a service?
Help us expand our detection patterns
The API Key Checker is a free, client-side security tool designed for developers, security professionals, penetration testers, and bug bounty hunters. It instantly identifies the type of API key, token, or secret you've discovered and provides everything you need to understand and validate it.
With support for 455+ patterns across 350+ services, including AWS, GitHub, Stripe, OpenAI, and many more, this tool helps you quickly assess discovered credentials during security assessments or incident response.
Unlike online validators that send your keys to remote servers, our tool runs entirely in your browser. Your sensitive credentials are never transmitted, stored, or logged. This makes it safe to use even with production keys during incident response.
Bug Bounty Hunting
Quickly identify and validate secrets found during reconnaissance. Get instant validation commands to prove impact in your reports.
Penetration Testing
Verify if discovered credentials are active during security assessments. Understand the blast radius of compromised keys.
Incident Response
Rapidly assess the impact of leaked credentials. Identify affected services and get remediation steps immediately.
Developer Security
Check if accidentally committed keys are still valid. Verify key rotation was successful after credential exposure.
Security Audits
Audit codebases for exposed secrets. Identify the service and risk level of any discovered API keys or tokens.
Paste Your Key
Enter any API key, token, or secret into the input field. The tool accepts single keys or text containing multiple secrets.
Pattern Matching
The tool runs your input against 455+ regex patterns for different services. High-confidence patterns (unique prefixes like ghp_,sk-ant-, AKIA) are prioritized.
Results & Guidance
View the identified service, risk level, what the key can access, and get ready-to-run validation commands with expected responses.
Paste any JSON Web Token and the tool now surfaces a dedicated JWT Inspector card: decoded header and payload (sorted keys, one-click copy), alg and typ chips, an expired flag when the exp claim is in the past, and a best-guess issuing service pulled from the iss claim. Every JWT-using service in the pattern database is listed inline with its own validation command, so you can test the token against Supabase, Auth0, Snowflake, Zoom, Monday.com, Prisma, Tinybird, Calendly or the generic JWT path without leaving the tab.
You no longer need to paste a complete API key to identify a service. Type a recognised prefix like sk-ant-, AQ.Ab, ghp_, nvapi-, AKIA or xoxb- and the tool surfaces the likely service with a "partial" chip. The shorter the input, the longer the candidate list, so you can disambiguate without ever having to paste a full production key.
Common envelopes are stripped before matching. Pasting Bearer sk-ant-..., Authorization: Bearer ... or OPENAI_API_KEY="sk-..." all resolve to the inner credential, so logs, dev-tool network tabs and .env lines work as-is.
Every detection now carries one of three chips. Verified means a high-confidence pattern matched AND the service has a central validation endpoint. Possible means the pattern matched but the service is self-hosted or has an ambiguous format (used for formats like OmniRoute and OMDb). Partial means the full-length pattern didn't fire but the input begins with (or is the beginning of) a known prefix.
When several services match a single input, you can now click any row in the "Other Possible Matches" card to swap the entire detection panel to that match. Description, risk level, access list, documentation link, remediation steps and validation command all follow the click. Useful when the top guess isn't the service you actually use.
Patterns added this cycle: Google AI Studio / Gemini authorization keys (AQ.Ab format replacing the legacy AIza standard keys as Google retires them for the Gemini API), NVIDIA keys issued at build.nvidia.com (nvapi- prefix with a token-only validation endpoint), OpenRouter LLM gateway keys (sk-or-v1-), Supabase 2026 formats (sb_publishable_ and sb_secret_ replacing the legacy anon/service_role JWTs), OMDb free-tier keys with the anchored-length detection pattern, and OmniRoute self-hosted LLM gateway as a "possible" match. The project tracker currently lists 465+ patterns.
Explore more SecurityWall security tools: Tools Hub |JWT Analyzer |Security Blog