Random API keys and tokens, 8-256 characters, hex, alphanumeric or symbol alphabets, optional prefix.
API Key Format Tester
Runs locally
Use API Key Format Tester
What it does
Check which known format a token fits, for example a key found in a phishing kit's configuration, before you report it to the service that issued it. Only the format is checked; the key is never tried.
It runs entirely in your browser: nothing you enter is uploaded.
Example
AWS documentation example key
AKIAIOSFODNN7EXAMPLELENGTH
20
PREFIX
none
CHARSET
Alphanumeric
PATTERN MATCHES
AWS Access Key, Base64Length 20, no prefix, alphanumeric; it matches the AWS Access Key pattern and also the generic Base64 pattern.
FAQ
Which formats does it recognise?
Ten regular expressions: Stripe secret and publishable keys (sk_ or pk_ with live or test), an older OpenAI format (sk- plus 32 or more letters and digits), GitHub ghp_ and ghs_ tokens, AWS access key IDs starting with AKIA, a Slack bot pattern, 32- and 64-character hex, UUID and Base64. A match only means the shape fits, and the generic patterns often match alongside a specific one.
Why does a real key show no match?
The list is short and partly outdated: OpenAI project keys (sk-proj-), GitHub fine-grained tokens (github_pat_), AWS temporary keys (ASIA) and current Slack bot tokens with two number groups are not matched. No match does not make a key fake, and a match does not make it valid.
Is the key sent anywhere?
No. The checks are regular expressions run in your browser; the key is not uploaded, stored or tried against the service.