Overview
Identify which provider an API key belongs to and whether its format is valid - entirely offline. The validator recognises OpenAI, Anthropic, Google Gemini, DeepSeek, Groq, xAI, Perplexity, HuggingFace, AWS, GitHub, Stripe, Slack and Supabase key formats, explains what it matched, and tells you the right next step. Because nothing is sent anywhere, it is safe to use on keys you suspect are exposed.
How It Works
Paste or type the key into the single input field. Once the string is longer than six characters, a verdict card appears: the provider name, whether the format was recognised, a sentence describing the specific pattern matched, and a next-step line of practical advice such as keeping the key server-side or scoping its permissions. Keys that look like credentials but match no known format get an honest 'credential-shaped, no provider match' verdict rather than a false claim. The page never calls any network endpoint, so it cannot tell you whether a key is active - only whether its shape is right.
Step-by-Step Usage Guide
- Paste the key into the input field.
- Read the verdict card: provider, format match, and detail line.
- Follow the next-step advice for that provider.
- Clear the field when done; nothing is stored.
Technical Specifications & Standards
Recognition is a table of fourteen anchored regular expressions run in order, each mapping to a provider, a description and advice. The patterns encode real format facts: OpenAI project keys are sk-proj- followed by at least 40 word characters; legacy OpenAI keys carry the distinctive T3BlbkFJ marker; Google keys are AIza plus exactly 35 characters; AWS access key IDs are AKIA plus 16 uppercase alphanumerics; GitHub tokens are a gh prefix plus at least 36 characters; Stripe keys carry a live-or-test segment between the sk_ or rk_ prefix and the body. A fallback rule recognises any 20-plus-character credential-shaped string without claiming a provider. The deliberate boundary: format validation is prefix-and-length checking, not authentication, so a matching key can be revoked and a mismatching key can be real. That is also why validation is safe - the key is never transmitted, so the tool cannot leak it while checking it.
Targeted Use Cases
- Identifying which service an unknown key in a config file belongs to.
- Checking whether a key you are about to share in a screenshot is recognisable.
- Debugging auth failures where the key format, not the key itself, is wrong.
- Security training: showing what each provider's key format looks like.
Notes & Gotchas
- Treat a recognised format as 'handle with care', not as proof of validity.
- Do not paste production keys into any tool - use a test key when learning formats.
- Use the next-step advice to check scope and expiry, which format alone cannot reveal.
- Combine with the secret scanner to sweep whole files rather than single keys.
Frequently Asked Questions
Does this check whether my key still works?
No. It validates format against known provider patterns and makes no network calls. Only the provider can confirm a key is active, and doing that requires sending it to them.
Is it safe to paste a real key here?
The key stays in your browser - nothing is transmitted or stored. Still, the safest habit is to paste test or revoked keys when you can.
Why does my real key say no format match?
Some providers issue multiple key generations or enterprise formats the rule table does not cover. A credential-shaped but unmatched verdict means exactly that: no known pattern matched.
What is the legacy OpenAI pattern?
Older OpenAI keys contain the literal segment T3BlbkFJ inside a sk- prefixed string. The validator flags them separately and suggests rotating to a project key.