API Key Validator: Format Recognition and Entropy, Not a Live Check
It's worth being upfront about what this tool can and can't do: it checks whether an API key's shape matches a known provider format and estimates its entropy — it cannot tell you whether the key is currently active, since that requires calling the provider's actual API, which this tool intentionally never does.
A rough proxy for guessability, not a guarantee the key was actually randomly generated.
Why Known Prefixes Exist
Providers like Stripe (sk_live_), GitHub (ghp_), and Google (AIza) deliberately give their keys a distinctive, recognizable prefix. This isn't just branding — it lets automated secret-scanning tools (in CI pipelines, in GitHub's own push-protection) recognize a leaked key of a specific type instantly, rather than needing every possible secret format memorized.
What Entropy Estimation Can and Can't Tell You
The entropy estimate looks at which character categories (lowercase, uppercase, digits, symbols) actually appear in the key and computes how large the space of possible keys of that shape would be. It's a reasonable proxy for guessability, but it can't distinguish a genuinely randomly generated key from a human-typed string that happens to mix character types — it measures the key's shape, not its actual randomness source.
Why This Tool Won't Call Any API
Actually checking whether a key is valid and active would mean sending your real secret to a third-party endpoint — exactly the kind of exposure a privacy-conscious tool should avoid. It would also require provider-specific logic for every possible API, which doesn't generalize. Format and entropy checking is what's reliably possible without those tradeoffs.
Practical Examples
Recognizing a Stripe Key
Format matches a known provider pattern.
- 1.Input: sk_live_4eC39HqLyjWDarjtT1zdp7dc
- 2.Match: Stripe (live secret key)
- 3.Entropy: ~130 bits
Flagging a Placeholder Value
Catching an obviously fake key.
- 1.Input: test_key_12345
- 2.Warning: starts with a common placeholder word
- 3.Not a real generated secret
Provider Formats Recognized
- Stripe: sk_live_, sk_test_, pk_
- GitHub: ghp_, github_pat_
- OpenAI: sk-
- Google: AIza
- AWS: AKIA, ASIA
- Slack: xox[b/a/p/r/s]-
- JWT: eyJ...eyJ... structure
What This Tool Deliberately Doesn't Do
- Call any provider's API to check validity
- Transmit your key anywhere
- Guarantee the key was actually randomly generated
- Replace a dedicated secret-scanning tool for codebases
Frequently Asked Questions
Can this tell me if my API key still works?
No — that requires actually calling the provider's API, which this tool deliberately doesn't do (both for privacy, since it never transmits your key, and because there's no universal way to check 'is this key valid' across every provider). It only checks the key's structure.
How does it recognize which provider a key belongs to?
By matching the key against known public format patterns — Stripe keys start with sk_live_/sk_test_/pk_, GitHub tokens start with ghp_ or github_pat_, Google API keys start with AIza, AWS access keys start with AKIA or ASIA, and so on. These prefixes are intentionally distinctive by design, partly so tools like secret scanners can recognize them.
What does the entropy estimate actually measure?
It estimates how many possible keys of that length/character-variety exist, in bits — a rough proxy for how hard the key would be to guess if it were randomly generated. It can't tell whether the specific key was actually generated randomly or is just human-typed text that happens to use varied characters.
Why does it flag a key with repeated characters?
A truly randomly generated key is very unlikely to contain long runs of the same repeated character — flagging this catches obviously fake, placeholder, or malformed keys (like 'aaaaaaaaaaaa') rather than real generated secrets.
Is this useful for finding leaked keys in code?
It's a building block — you could use it to confirm whether a suspicious string found in a codebase matches a known API key format, but for actually scanning a codebase for leaks at scale, use a dedicated secret-scanning tool (like our Secret Scanner) designed for that.
Is my key sent anywhere?
No, format and entropy checking both happen entirely in your browser via regex matching — no network request.