# API Key Format Tester

URL: https://phishdestroy.io/developer-tools/api-key-format-tester
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Check which known format a token fits, for example a key found in a phishing kit's configuration, before you report it to the service that issued it. Only the format is checked; the key is never tried.

## Example input

AWS documentation example key

```
AKIAIOSFODNN7EXAMPLE
```

Length 20, no prefix, alphanumeric; it matches the AWS Access Key pattern and also the generic Base64 pattern.

## FAQ

### Which formats does it recognise?

Ten regular expressions: Stripe secret and publishable keys (sk_ or pk_ with live or test), an older OpenAI format (sk- plus 32 or more letters and digits), GitHub ghp_ and ghs_ tokens, AWS access key IDs starting with AKIA, a Slack bot pattern, 32- and 64-character hex, UUID and Base64. A match only means the shape fits, and the generic patterns often match alongside a specific one.

### Why does a real key show no match?

The list is short and partly outdated: OpenAI project keys (sk-proj-), GitHub fine-grained tokens (github_pat_), AWS temporary keys (ASIA) and current Slack bot tokens with two number groups are not matched. No match does not make a key fake, and a match does not make it valid.

### Is the key sent anywhere?

No. The checks are regular expressions run in your browser; the key is not uploaded, stored or tried against the service.

## Related tools

- [API Key & Token Generator](https://phishdestroy.io/developer-tools/api-token-generator)
- [JWT Decoder](https://phishdestroy.io/developer-tools/jwt-decoder)
- [Multi-Layer Decoder](https://phishdestroy.io/developer-tools/multi-layer-decoder)
- [Basic Auth Header Generator / Decoder](https://phishdestroy.io/developer-tools/basic-auth-header)

All tools: https://phishdestroy.io/developer-tools