Free tools Windows power users keep installed
One-click scans. No signup required.
To rotate a service-account credential without breaking workloads, inventory every consumer, replace the credential in stages, verify each workload, then disable and remove the old credential. To limit blast radius if a credential leaks, reduce what its identity can do and who can use or impersonate it before an incident. Prefer workload identity, federation, or temporary credentials when supported; rotation is the fallback for credentials that must remain.
What determines a credential’s blast radius?
A leaked credential is only as powerful as the identity behind it: the resources that identity can reach, the actions it can perform, and the people or external identities that can obtain or impersonate it. A key may therefore create risk beyond the workload that normally uses it. Google Cloud warns that broad project-level Service Account Token Creator access can allow impersonation of every service account in the project. A service-account key can also make attribution difficult because logs may not reliably show who used it.
As an Amazon Associate I earn from qualifying purchases.
Assess both sides of the exposure: what the credential’s principal can access, and who can create, upload, distribute, or impersonate credentials for that principal. Google Cloud warns that leaked keys can provide a foothold and may enable privilege escalation.
What should you inventory before changing a credential?
Build an inventory that connects each credential to its owners and consumers. Search managed key inventories, source control, build pipelines, deployment configuration, runtime environments, secret stores, backups, and operational scripts. Google Cloud recommends identifying keys due for rotation and points to Cloud Asset Inventory; key-use metrics and service-account insights can help identify use or inactivity. Metric scope matters: Google’s best-practice guidance notes that project-level scope affects these metrics.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Credential type, key ID, creation date, and last-use evidence, where available.
- Owning principal, accountable team or person, environment, and dependent services.
- Every workload and integration that can still authenticate with the credential, including infrequent jobs.
- Where copies are stored or distributed, and which people or federated identities can create, upload, or impersonate credentials.
- Permissions granted to the principal and the resources those permissions reach.
Record the inventory in a form that lets you track each consumer’s migration and verification. A successful deployment alone does not establish that a dormant batch job or infrequent integration has been updated; that is a practical consequence of needing to replace the key in every application.
Can you eliminate the persistent credential instead?
Before rotating a long-lived key, check whether the workload can use a provider-supported identity mechanism. For Google Cloud workloads, consider an attached service account or Workload Identity Federation where supported. Federation lets an external workload exchange its existing identity-provider credential for short-lived Google credentials. AWS recommends IAM roles and temporary credentials instead of long-term access keys where feasible. These approaches can remove persistent private keys from the workload and reduce the number of secrets that need rotation.
A secrets manager is not automatically a substitute for a cloud identity. Google Cloud specifically advises against storing and rotating Google service-account keys in Secret Manager: if a workload can access the manager using a recognized cloud identity, it may be able to use that identity directly instead. The same reasoning applies to other cloud secret stores. AWS separately recommends purpose-built secret storage and automated rotation for long-lived secrets that cannot be removed or replaced. Choose the identity design and storage approach for the provider and credential type involved.
Recommended Free Tools
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
How do you reduce the credential’s scope?
Review permissions before the next rotation or incident. Grant access at the narrowest suitable resource scope, remove unused roles, and restrict which external identities can impersonate the service account. Google Cloud’s federation guidance calls for limiting both the external identities allowed to impersonate a service account and the resources available to that account. Avoid broad project-level token-creator grants where narrower access is sufficient.
Where service-account keys are unnecessary, Google Cloud recommends organization-policy constraints that disable key creation and upload. Its service-account best practices also call for audit logging of impersonation and token requests in the relevant IAM and Security Token Service APIs.
What is the safe sequence for rotating a credential that must remain?
Google Cloud’s managed-key guidance uses a staged replacement: identify the keys, create replacements for the same service accounts, update applications, disable the replaced key and monitor, then delete it after the applications work as expected. Apply the equivalent provider-specific controls for other credential types.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
- Identify the old credential and all consumers. Use the inventory to define the migration scope and identify an owner for each workload.
- Create the replacement. Create a new credential for the same principal, or establish the replacement identity mechanism. Store and distribute it through the approved path.
- Update consumers one by one or in controlled groups. Track which workloads have changed; do not assume that updating the primary application updates every job, integration, or environment.
- Verify authentication and required actions. Confirm each consumer can authenticate and still perform its intended work. Check relevant error rates and audit events, and record the result.
- Disable the old credential and monitor. Watch for failed consumers or unexpected attempts. Keep a rollback decision tied to the old credential’s state rather than deleting it before validation.
- Delete the old credential after confirmation. Remove it once the replacement is confirmed and monitoring shows the expected behavior.
This sequence reduces the risk of an immediate cutover outage, but it does not guarantee that an overlooked consumer will be found. Keep the overlap only as long as needed to validate the migration, then remove the old credential.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat changes if compromise is suspected?
Treat suspected compromise as an incident, not as a routine rotation window. Google Cloud recommends rotating a suspected-compromised service-account key immediately. Follow the provider-specific emergency revocation procedure for the credential class, identify the workloads and resources it could reach, and investigate unexpected use.
- Preserve relevant audit records and available key-use evidence before changing or deleting artifacts needed for investigation.
- Review the principal’s permissions, impersonation paths, and downstream resources for unauthorized access or changes.
- Replace or revoke the credential promptly, then remove identity permissions that are no longer needed.
- Check dependent workloads for authentication failures and confirm that the replacement credential is working.
A routine schedule is not a substitute for least privilege, monitoring, or incident response. AWS Well-Architected also advises periodic audits for unauthorized identities and unexpected activity.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
How often should you rotate credentials?
Use provider- and credential-specific guidance, not a universal interval. Google Cloud’s current documentation, accessed in 2026, recommends rotating service-account keys at least every 90 days to reduce risk from leaked or stolen keys. AWS Well-Architected recommends a maximum interval of every 90 days for long-term IAM access keys when temporary credentials cannot be used. These are operational recommendations in living vendor documentation, not measured statistics about risk reduction, and neither establishes a universal schedule for every service-account credential, workload identity, or third-party API token.
Google Cloud cautions that expiring service-account keys can cause production workload outages if rotation is missed and does not recommend expiry-based rotation for production workloads. Do not configure automatic expiration or rotation without a tested overlap, consumer migration, monitoring, and recovery design. For unavoidable long-lived secrets, AWS recommends automated rotation; confirm that the mechanism suits the credential and dependent workloads.
Which approach should you choose?
| Approach | Persistent private key | Lifetime and renewal | Scope and operations |
|---|---|---|---|
| Workload identity, federation, or temporary role credentials | Can remove the workload’s need for a persistent private key when supported. | Federation can exchange an external identity-provider credential for short-lived Google credentials; AWS recommends temporary role credentials where feasible. | Constrain which identities can obtain or impersonate the workload identity and what resources it can reach. Provider support and configuration vary. |
| Staged replacement of a managed key | Yes; the replacement remains a persistent key. | Create a replacement, update consumers, verify, disable the old key, monitor, then delete it. | Requires finding every consumer and coordinating the transition; forgotten or infrequent workloads can fail when the old key is disabled. |
| Secret storage and automated rotation for a residual long-lived secret | Yes; the secret remains, though storage and rotation can be managed. | AWS recommends automated rotation for long-lived secrets that cannot be removed or replaced; the credential-specific mechanism is not universal. | Use provider-appropriate identity and storage design. Google Cloud advises against using Secret Manager to store and rotate Google service-account keys when the workload can use a recognized cloud identity directly. |
Compare the options against the actual workload: whether a persistent key remains, how credentials are renewed, identity and resource scope, audit attribution, the number of copies and consumers to update, outage and rollback behavior, and provider support. For provider-specific commands, limits, logging locations, and emergency revocation, follow the documentation for the actual provider and credential class.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
