You found a key. It was in a commit, a log file, a screenshot in a ticket, or a config someone emailed you two years ago. Before you can decide how urgently to act, you need to know three things: whose key it is, what it can reach, and how to kill it. This tool answers all three from the key's format alone, without contacting anyone.
What identification tells you
Matching a key against a provider signature gives you the vendor, the credential type, and — most usefully — the scope. sk_live_ is not just "a Stripe key"; it is full API access to a live account, including the ability to change payout destinations. ghs_ is a GitHub App installation token that expires within the hour. The difference determines whether you page someone.
Each match includes the revocation path, because the correct first action is always to revoke. Investigation takes hours; revocation takes seconds.
Live or test
The environment discriminator reads the key's own structure. Stripe encodes it directly (sk_live_ versus sk_test_). AWS uses the first four characters — AKIA for a long-lived IAM key, ASIA for a temporary STS credential that expires on its own. Where no marker exists, the tool says "indeterminate" rather than guessing, because a wrong reassurance here is worse than no answer.
The fingerprint
The composition panel includes a truncated SHA-256 of the key. This is genuinely useful during an incident: you can ask "is the key in your environment the same one that leaked?" and compare fingerprints, without either party ever sending the key. Two systems holding the same value produce the same fingerprint; different values produce different ones.
What a non-match does not mean
Many credentials have no distinguishing shape at all. An AWS secret access key is 40 characters of Base64-ish text. Most Azure keys, Datadog keys and countless internal tokens are indistinguishable from any other random string. A clean result means "no signature matched", not "this is safe".
Frequently asked questions
Is it safe to paste a production key here?
Yes. The matching runs in your browser against a pattern library bundled with the page. Load the page, disconnect from the network, and it still identifies keys — which is the test worth running before you trust any tool with a credential.
The key was not recognised. Should I relax?
No. Judge it by where you found it and what it is passed to. If it appeared next to a DATABASE_PASSWORD= assignment, it is a database password regardless of whether it matches a signature. Run the entropy calculator to see whether it looks machine-generated.
How many providers are covered?
The library holds high-confidence signatures for the providers whose formats are distinctive enough to match reliably — payments, cloud, source control, package registries, AI providers, communications and databases. Patterns that would fire on any long hex string are marked low-confidence and excluded by default, because a scanner with a high false-positive rate is a scanner people learn to ignore.
What should I do first if the key is real?
Revoke it. Then issue a replacement, deploy it, check the provider's audit log for the key's entire validity window, and only then work out how it leaked. The revocation command generator produces the exact commands per provider.