Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Treat an API key as exposed if its value has appeared anywhere outside the boundary intended to keep it secret: for example, in a public repository, log, build artifact, mobile app, shared file, email, or backup. A provider or scanner alert is enough to start responding; you do not need proof that someone used the key before revoking it. Preserve evidence, assess what the key can access, contain it at the provider, replace it safely, and then investigate and clean up copies.
What counts as an exposed API key?
An API key is exposed when someone who should not be able to retrieve or use it could have obtained its value. The important question is not whether the file was labeled “private” or whether you can still find the key in its original location. It is whether the value crossed the boundary that was supposed to protect it.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common places to check include public or shared code repositories, issue trackers, application and server logs, build artifacts, container images, mobile or client-side applications, email, file shares, backups, and temporary files. Google warns that attackers search public repositories, buckets, dumps, email, file shares, backups, and temporary files for service-account keys. A secret can also be copied before it is removed from any of those locations.
Exposure is not the same as confirmed misuse. A key can be exposed without any suspicious request being visible, and unfamiliar usage is a reason to investigate even if you have not yet found the key in a file. Handle the exposure as a security incident first; determine what happened and the impact as you gather evidence.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can I tell whether a key leaked?
Start with direct evidence that the key value was disclosed, then look for alerts and activity that may show whether it was used. Unusual activity strengthens the case for compromise, but it is not a prerequisite for containment.
Look for the value outside its intended location
Search the places the key could have reached: repository files and history, pull requests and issues, CI output, logs, build outputs, container layers, shared documents, email, and backups. Consider whether the key was embedded in a client application or distributed to users; credentials placed in software that leaves your control should not be treated as confidential from its recipients.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA secret-scanning alert, provider notification, or report from a colleague is itself a reason to start incident handling. OpenAI says that when it detects an API key on the public internet or leaked inside an app in an app store, it disables the key immediately. That is an example of provider action, not a guarantee that every provider will detect every exposure or respond in the same way.
Check for corroborating activity
Review the provider’s available usage, billing, authentication, and audit information for unfamiliar requests, locations, activity, or spending. Compare what you find with the key’s owner, intended application, normal use, and deployment context. An unexpected charge or request is evidence to investigate; it does not by itself identify where the key leaked.
Do not wait for anomalous activity to appear. A copied key may not be used immediately, and the absence of an alert or suspicious usage does not show that no one copied it. GitHub’s guidance is to consider a leaked secret immediately compromised.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When should I revoke an API key?
Revoke or disable the key immediately when it was public, when a provider or scanner alerts you, when you see unfamiliar usage or spending, or when it is an active production or privileged credential. Do the same if it is embedded in a distributable application or you cannot establish who may have copied it. AWS says to “Rotate or revoke it immediately after detection,” and OWASP recommends immediate revocation of exposed keys.
Revoke now if the consequences or uncertainty are high
- The key appeared in a public repository, shared artifact, or other location accessible beyond its intended audience.
- It can access production systems, sensitive data, or broad API scopes.
- A provider or scanner reported it, or usage, authentication, or spending looks unfamiliar.
- The key was shipped in a client application or you cannot reliably identify everyone who had access to the exposed copy.
These are decision rules for limiting risk, not claims that misuse has already occurred. The cost of a controlled replacement is generally preferable to leaving a credential usable while you wait for conclusive evidence.
Coordinate a short replacement window for lower-risk cases
A private, inactive test or development key with a known owner and no suspicious use may allow a brief, coordinated replacement rather than an unplanned outage. Generate and deploy its replacement promptly, verify that the intended consumer works, and then revoke the old credential. GitHub still recommends remediation for medium- and low-risk leaks; a private repository is not a reason to ignore a key that crossed its intended boundary.
If you cannot quickly confirm that the key is inactive, low-privilege, and limited to known users, treat the uncertainty as a reason to revoke. Do not rely on deleting a file, rewriting repository history, or removing and recreating a repository: none of those actions can recall copies already made or make an exposed credential unusable.
What should I do after finding an exposed key?
Move quickly, but preserve enough information to understand the incident. GitHub advises responders to capture screenshots and export logs because opening a support ticket does not preserve logs. Keep the response focused on containment and replacement rather than treating code cleanup as the fix.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Preserve evidence. Record the alert or report, the exposed file or commit location, relevant timestamps, repository visibility, the key’s owner and known scopes, and available usage or audit information. Save screenshots or export logs before cleanup where possible.
- Assess the blast radius. Determine whether the key is public, active, production, privileged, shared, embedded in a client, or present in more than one location. Identify every service, deployment, script, image, and person that may use it. GitHub recommends considering multiple-leak alerts, last use, scope, repository visibility, and production context.
- Contain it at the issuer. Use the provider’s console or API to revoke or disable the exposed key. This is the action that makes the old credential unusable; deleting its visible copy is not a substitute.
- Create and deploy a replacement. Issue a new key with only the permissions the affected workload needs. Update the relevant secret storage and consumers, deploy the change, and verify that authenticated calls work with the replacement.
- Invalidate the old key after a planned transition. For a controlled rotation, keep any overlap between old and new credentials only as long as needed to move consumers. Once the replacement is verified, revoke the old key. If compromise is suspected, prioritize immediate containment rather than preserving an overlap that leaves the exposed key usable.
- Clean up remaining copies. Remove the secret from current files, CI variables, container layers, logs, tickets, caches, and repository history where practical. AWS recommends removing exposed secrets from source-control history after revocation. Cleanup reduces future discovery but does not reverse the exposure.
- Investigate and document. Review provider usage, billing, authentication, and audit trails for unauthorized calls. Record what was exposed, the decisions and notifications made, and any impact found. If misuse or data access is confirmed, follow the organization’s incident, legal, and privacy processes.
How do I rotate a key without taking production down?
For a planned rotation, use a short overlap: make the replacement available, move consumers to it, confirm they work, and then invalidate the old key. The aim is to avoid a gap in valid credentials without leaving the previous credential active longer than necessary.
Map consumers before changing the credential
List every service, deployment, job, script, or other consumer that uses the key, including copies outside the main application. Identify where each consumer reads the credential and who owns its deployment. If the key is shared across unrelated workloads, replacing it may affect more than one release; that is a reason to map its use, not a reason to leave an exposed key active indefinitely.
Use a controlled change and verify it
- Create a replacement key with the narrowest permissions suitable for the affected workload.
- Store it in the intended secret store or environment configuration, not in source code or a committed
.envfile. - Update consumers and deploy the change. Check that their authenticated calls succeed using the replacement.
- Revoke the former key once the replacement is working and the necessary consumers have moved.
- Review usage and logs for failures or unexpected activity associated with the transition.
If the old key is actively exposed or misuse is plausible, containment takes priority over a zero-interruption migration. Revoke it at the issuer and restore affected services with the new credential. No rotation sequence can guarantee uninterrupted operation without knowing the provider, application architecture, and deployment setup, so verify the service’s behavior rather than assuming the rollout succeeded.
Why doesn’t deleting the key from a repository solve the problem?
Deleting the current file removes one visible copy; it does not invalidate the credential or erase copies that someone may already have made. A pushed cleanup commit, history rewrite, or repository deletion likewise cannot ensure the exposed value has disappeared from every clone, cache, artifact, or other location.
GitHub identifies revocation as the most immediate containment action and warns that removing a secret from code, pushing a new commit, or deleting and recreating a repository does not prevent exploitation. AWS likewise recommends revoking or rotating first, then removing the secret from source-control history. Treat repository cleanup as an additional hygiene step after the key is no longer usable.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can I make future API key exposure less likely?
Use controls that prevent disclosure, limit what a leaked key can do, make discovery faster, and reduce the time a credential remains useful. No single scanner or provider feature covers every place a value can escape.
Keep secrets out of code and plaintext logs
- Store credentials in environment variables or a secrets manager instead of hard-coding them.
- Do not commit
.envfiles or other local secret files. - Keep secrets out of application logs and shared outputs; OWASP’s Secrets Management Cheat Sheet calls for secrets that are short-lived, automatically rotatable, least-visible, revocable, and absent from plaintext logs.
Find leaks at more than one point
Enable repository secret scanning, add pre-commit and CI scans, and schedule recurring scans. Repository scanning can improve discovery in code, but it cannot replace the issuer-side action that disables a credential. When comparing controls, consider whether they cover public and private code, logs, images, and client applications; how quickly they alert; and whether they can disable a detected key automatically.
Limit the damage a single key can cause
Where the provider supports it, restrict a key by API, host, referrer, IP, application, scope, or project. Use separate credentials for different projects or features, short expiry where practical, and spend thresholds and usage alerts. These controls make a credential easier to isolate and can help reveal unexpected use; they do not make an exposed key safe to keep active.
Recommended Free Tools
Use provider features, but verify their settings
Google recommends deleting unused keys and rotating keys periodically. Google Cloud announced that automatic disabling of detected exposed service-account keys would be activated by default on June 16, 2024, when the organization policy is configured for DISABLE_KEY. Detection is not guaranteed, and a dated announcement is not proof that a particular organization’s current settings or provider behavior are enabled; verify the applicable policy and configuration.
When evaluating detection and response options, look beyond whether a tool finds a string in a repository. Check alert timing, automatic disablement, permission controls, rotation automation, audit-log detail and retention, isolation between workloads, deployment integration, and outage handling. Provider-native controls are usually fastest for that provider; repository scanners add discovery coverage but do not replace revocation at the issuer.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should I remember when responding?
Exposure is a condition of the key’s disclosure, not a conclusion that an attacker has already used it. Preserve evidence, use the provider to make the credential unusable, replace it with a least-privilege key, and then investigate and remove residual copies. The urgency depends on access and context, but uncertainty about who could have copied a usable key is itself a reason to act.
Frequently Asked Questions
Can a provider disable an API key after finding it in an app store?
Some providers may do so: OpenAI says it immediately disables API keys it detects on the public internet or leaked inside an app in an app store. That statement describes OpenAI’s stated response and should not be assumed to apply to other issuers.
Does rotating keys periodically prevent every leak?
No. Periodic rotation can limit how long a credential remains useful, but it cannot prevent a newly rotated key from being disclosed. Keep scanning, access restrictions, and incident response in place as well.
What information should I have ready when contacting my provider?
Have the key owner, affected service, exposure location and time, repository visibility, known scopes, and relevant usage or audit records available. Preserve those details before cleanup when possible, since a support ticket alone may not preserve provider or repository logs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
