# Found a Random API Key? 🔍 Here's How to Know If It's Treasure or Trash

**URL:** <https://onehack.st/t/found-a-random-api-key-heres-how-to-know-if-its-treasure-or-trash/317185>\
**Category:** Tools & Scripts\
**Tags:** hacking, freebies\
**Created:** [January 22, 2026, 8:39pm UTC](https://onehack.st/t/found-a-random-api-key-heres-how-to-know-if-its-treasure-or-trash/317185 "2026-01-22T20:39:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [January 22, 2026, 8:39pm UTC](https://onehack.st/t/found-a-random-api-key-heres-how-to-know-if-its-treasure-or-trash/317185/1 "2026-01-22T20:39:17Z")

</div>

# 🔑 API Key Validators: The Complete Arsenal

> **🗺 One-Line Flow:** Mystery string → instant verdict → “it’s a live Stripe key with full permissions, go collect your bounty.”

* * *

You’re poking around some startup’s public GitHub. Buried in a config file, you spot this:

```auto
AKIA3EXAMPLE7KEYHERE

```

Is it real? Is it expired? Is it a honeypot? Is it connected to an AWS account with $47,000 in credits?

**You could:**

- Google “how to check AWS key” (25 minutes of garbage)
- Paste it into some sketchy online checker (congrats, now _they_ have it)
- Ask Discord and get clowned

**Or:** Run one command, know everything in 4 seconds, move on with your life.

That’s what these tools do. The difference between “I think I found something” and “here’s the screenshot for my $2,000 bounty report.”

* * *

## 🧒 Baby’s First Glossary

> Skip this if you’ve touched a terminal before.

> **Words I'll Use (30-Second Crash Course)**
>
> | Word | Plain English |
> | --- | --- |
> | **CLI** | Command-line interface. The black/white terminal window. You type, it does. |
> | **Go** | A programming language. Installing Go tools = `go install blah@latest` |
> | **pip** | Python’s app store. `pip install thing` = download Python tool |
> | **git clone** | Download a project from GitHub to your computer |
> | **Regex** | Pattern matching. How tools recognize “this looks like a Stripe key” |
> | **Binary** | A ready-to-run program. No setup, just download and execute |
> | **Repo** | Repository. A project folder on GitHub |
> | **API** | How apps talk to each other. Your key = your password to that conversation |
> 
> You’re good now. Let’s go.

* * *

## 🏆 The Rankings

Ranked by: _“I have a mystery key, how fast can I get answers?”_

* * *

> **🥇 #1 — Nuclei Token-Spray: The Slot Machine That Pays Out**
>
> **The vibe:** You have a weird key. No clue what service. This throws it at 100+ APIs simultaneously like a casino pull. When something hits, you know exactly what you’ve got.
> 
> **Why it’s king:**
> 
> - Found a random `sk_` string? Spray it. Stripe, SendGrid, and 98 others get tested in seconds.
> - Community updates it constantly (new API = new template within weeks)
> - Used by actual professionals, not just “GitHub star collectors”
> 
> **Get it running:**
> 
> ```bash
> # Install (one time)
> go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
> nuclei -update-templates
> 
> # Check one key
> nuclei -t http/token-spray/ -var token=sk_live_xxxxxx
> 
> # Check a whole file of keys
> nuclei -t http/token-spray/ -var token=mystery_keys.txt
> 
> ```
> 
> **What you see:**
> 
> ```auto
> [api-stripe] [http] [info] Token is valid for Stripe
> 
> ```
> 
> That’s it. Mystery solved.
> 
> 🔗 [Nuclei](https://github.com/projectdiscovery/nuclei) — [Token-spray templates](https://github.com/projectdiscovery/nuclei-templates/tree/main/http/token-spray)

> **🥈 #2 — TruffleHog: The War Crime Scanner**
>
> **The vibe:** Doesn’t just find secrets. Finds them, calls the actual API to verify they work, tells you what permissions they have, and scans through years of git history including stuff the developer “deleted.”
> 
> **Why it’s terrifying:**
> 
> - 800+ secret types recognized
> - Finds AWS key → actually calls AWS → confirms it works → tells you it has S3 admin access
> - Scans deleted commits (people think `git rm` = gone forever. lol.)
> - Works on GitHub, GitLab, Docker images, S3 buckets, Slack exports, local files…
> 
> **Get it running:**
> 
> ```bash
> # Install
> brew install trufflehog
> # or: go install github.com/trufflesecurity/trufflehog/v3@latest
> 
> # Scan any public repo
> trufflehog git https://github.com/some-startup/their-app
> 
> # Only show CONFIRMED WORKING secrets (skip the noise)
> trufflehog git https://github.com/target --only-verified
> 
> # Scan local folder
> trufflehog filesystem /path/to/sus/code
> 
> ```
> 
> **What you see:**
> 
> ```auto
> ✓ Verified: AWS Access Key
> Account ID: 123456789012
> ARN: arn:aws:iam::123456789012:user/dev-brian
> 
> ```
> 
> Brian’s having a bad day.
> 
> 🔗 [TruffleHog](https://github.com/trufflesecurity/trufflehog)

> **🥉 #3 — keyhacks.sh: The Cheat Sheet That Types Itself**
>
> **The vibe:** 60+ services. You say “check this Slack token”, it runs the exact curl command, tells you valid or not. No thinking.
> 
> **Why it survives:**
> 
> - Zero dependencies except bash (works on a potato)
> - Been around forever, battle-tested
> - You can read the code in 5 minutes and understand everything
> 
> **Get it running:**
> 
> ```bash
> git clone https://github.com/gwen001/keyhacks.sh
> cd keyhacks.sh
> chmod +x keyhacks.sh
> 
> # Use it
> ./keyhacks.sh stripe sk_live_xxxxxxxxxxxx
> ./keyhacks.sh slack xoxb-xxxxxxxxxxxx
> ./keyhacks.sh aws AKIAXXXXXXXX SECRETKEYHERE
> ./keyhacks.sh github ghp_xxxxxxxxxxxx
> 
> ```
> 
> **Supports:** Algolia, Asana, AWS, Azure, Bitly, BrowserStack, Cloudflare, DataDog, Deviant Art, Dropbox, Facebook, Firebase, GitHub, GitLab, Google (multiple), Heroku, Infura, Instagram, Mailchimp, Mailgun, Mailjet, Mapbox, OpsGenie, PagerDuty, PayPal (sandbox + live), Pendo, Salesforce, SauceLabs, SecurityTrails, SendGrid, Slack, Square, Travis CI, Twilio, Twitter… I’m tired of typing.
> 
> 🔗 [keyhacks.sh](https://github.com/gwen001/keyhacks.sh) — [Original keyhacks reference](https://github.com/streaak/keyhacks)

> **\#4 — APIKeyzer: The Reboot We Needed**
>
> **The vibe:** Someone finally said “what if apiguesser + keyhacks had a baby?” Single Go binary. Key in, answer out. No setup drama.
> 
> **Why it’s exciting:**
> 
> - Exactly what the archived Key-Checker was
> - Identifies service + validates in one step
> - 2025 code, not 2021 spaghetti
> 
> **Get it running:**
> 
> ```bash
> go install github.com/Xplo8E/APIKeyzer/cmd/apiKeyzer@latest
> 
> apiKeyzer --key "sk_live_xxxxxxxxxxxxx"
> apiKeyzer --list keys.txt
> cat keys.txt | apiKeyzer
> 
> ```
> 
> **Caveat:** Fresh repo, low stars. Works, but you’re an early adopter.
> 
> 🔗 [APIKeyzer](https://github.com/Xplo8E/APIKeyzer)

> **\#5 — apiguesser: From the Guy Who Started All This**
>
> **The vibe:** Same author as the original Key-Checker (daffainfo). You give it a key with ZERO context, it figures out what service based on the format, then checks if valid.
> 
> **Why it matters:** When you genuinely have no idea what something is.
> 
> ```bash
> go install github.com/daffainfo/apiguesser@latest
> 
> ./apiguesser -api "AIzaSyD-xxxxxxxxxxxxx"
> # Output: "Google Maps API Key" + validity check
> 
> ```
> 
> **Lazy version:** [api-guesser.netlify.app](https://api-guesser.netlify.app) — paste key, click button, done.
> 
> 🔗 [apiguesser](https://github.com/daffainfo/apiguesser) — [Web UI](https://api-guesser.netlify.app)

> **\#6 — AdvancedKeyHacks: For the Menu Lovers**
>
> **The vibe:** Interactive menu. Pick service from list, paste key, get result. For people who hate memorizing flags.
> 
> ```bash
> git clone https://github.com/udit-thakkur/AdvancedKeyHacks
> cd AdvancedKeyHacks && chmod +x *.sh
> ./hackcura_apikey_hacks.sh
> 
> ```
> 
> 45+ services. Point and click energy.
> 
> 🔗 [AdvancedKeyHacks](https://github.com/udit-thakkur/AdvancedKeyHacks)

> **\#7 — Api-Key-Checker: Python, Simple, Growing**
>
> **The vibe:** Python CLI. Google, Firebase, OpenAI, Stripe, Facebook. Clean output, beginner-friendly.
> 
> ```bash
> git clone https://github.com/mahfuz33R/Api-Key-Checker
> cd Api-Key-Checker
> pip install -r requirements.txt
> python apikey_checker.py
> # Enter keys comma-separated when prompted
> 
> ```
> 
> Not the biggest coverage, but it’s readable code you can extend yourself.
> 
> 🔗 [Api-Key-Checker](https://github.com/mahfuz33R/Api-Key-Checker)

> **\#8 — dora: Finds Keys AND Tells You How to Abuse Them**
>
> **The vibe:** Scans folders using ripgrep (stupid fast), finds secrets, then shows exploitation steps for each type. Most tools stop at “found key.” This one says “found key, here’s the curl command to drain their Stripe balance.”
> 
> ```bash
> git clone https://github.com/sdushantha/dora
> cd dora && python3 setup.py install --user
> 
> dora /path/to/scan/
> 
> ```
> 
> **Requires:** [ripgrep](https://github.com/BurntSushi/ripgrep) installed first.
> 
> 🔗 [dora](https://github.com/sdushantha/dora)

> **\#9 — KeyLeak Detector: Scan Live Websites Like a Psycho**
>
> **The vibe:** Opens target website in headless browser, intercepts ALL traffic (XHR, WebSocket, everything), scans JS bundles, headers, API responses. Finds stuff static scanners physically cannot see.
> 
> ```bash
> git clone https://github.com/Amal-David/keyleak-detector
> cd keyleak-detector
> docker compose up -d
> # Open http://localhost:5002
> # Enter target URL, hit scan
> 
> ```
> 
> Uses Playwright + mitmproxy under the hood. Patterns pulled from Gitleaks automatically.
> 
> 🔗 [keyleak-detector](https://github.com/Amal-David/keyleak-detector)

> **\#10 — Gitleaks: The Speed Freak (Detection Only)**
>
> **The vibe:** Scans at GB/s. Perfect for CI/CD pipelines and pre-commit hooks. Finds potential secrets, does NOT verify them.
> 
> ```bash
> brew install gitleaks
> gitleaks detect --source . --verbose
> 
> ```
> 
> **Use case:** Block commits containing secrets. Pair with TruffleHog or keyhacks to verify what it finds.
> 
> 🔗 [Gitleaks](https://github.com/gitleaks/gitleaks)

> **\#11 — Nosey Parker: When You're Drowning in False Positives**
>
> **The vibe:** Rust + machine learning. 188 rules, lowest false-positive rate in the game. For when other tools cry wolf too much.
> 
> 🔗 [Nosey Parker](https://github.com/praetorian-inc/noseyparker)

* * *

## 📚 The Pattern Libraries

> Not tools — raw materials. For building your own scanner or understanding how detection works.

> **secrets-patterns-db — 1,600+ Regex Patterns**
>
> The largest open-source pattern database. Every secret type imaginable. Export to Gitleaks or TruffleHog format with one command.
> 
> ```bash
> git clone https://github.com/mazen160/secrets-patterns-db
> python3 convert.py --export gitleaks
> 
> ```
> 
> 🔗 [secrets-patterns-db](https://github.com/mazen160/secrets-patterns-db)

> **keyhacks (Original) — The Reference Bible**
>
> 80+ services. Raw curl commands with expected responses. Every other tool on this list borrowed from here.
> 
> ```bash
> # Example from the repo:
> curl -sX POST "https://slack.com/api/auth.test?token=xoxp-TOKEN"
> # Valid = returns team info. Invalid = returns error.
> 
> ```
> 
> 🔗 [keyhacks](https://github.com/streaak/keyhacks)

> **all-about-apikey — The Documentation Nobody Asked For (But We Needed)**
>
> 150+ services. Each one has:
> 
> - Description
> - Regex pattern
> - Example request
> - Example response
> - What valid vs invalid looks like
> 
> From the same author as Key-Checker. Absolute unit of a reference.
> 
> 🔗 [all-about-apikey](https://github.com/daffainfo/all-about-apikey)

> **secret-regex-list — Copy-Paste Into Python**
>
> Pre-formatted regex patterns ready to drop into your Python code. No conversion needed.
> 
> 🔗 [secret-regex-list](https://github.com/h33tlit/secret-regex-list)

* * *

## ⚡ Decision Matrix

_Stop thinking. Use this._

| Situation | Tool | Command |
| --- | --- | --- |
| Random key, no clue what it is | Nuclei token-spray | `nuclei -t http/token-spray/ -var token=KEY` |
| Scan whole repo + verify working | TruffleHog | `trufflehog git URL --only-verified` |
| Know the service already | keyhacks.sh | `./keyhacks.sh servicename KEY` |
| Scan live website (JS, headers, etc) | keyleak-detector | Browser UI at localhost:5002 |
| Pre-commit CI/CD (speed matters) | Gitleaks | `gitleaks detect --source .` |
| Need to guess what service | apiguesser | `./apiguesser -api KEY` |
| Building your own tool | secrets-patterns-db | 1,600 patterns ready to export |
| Want the simplest possible UX | APIKeyzer | `apiKeyzer --key KEY` |

* * *

## 🕸 How This All Connects

```auto
streaak/keyhacks (2019, the original bible)
    │
    ├── gwen001/keyhacks.sh (automation layer)
    ├── AdvancedKeyHacks (interactive menus)
    └── nuclei token-spray (industrial scale)

daffainfo (Key-Checker creator)
    │
    ├── Key-Checker (archived 2021, RIP)
    ├── apiguesser (spiritual successor)
    ├── all-about-apikey (documentation)
    └── api-guesser.netlify.app (web version)

APIKeyzer (2025) = apiguesser + keyhacks combined

Detection tier:
    ├── Gitleaks (fast, no verify)
    ├── Nosey Parker (ML-powered, precise)
    └── TruffleHog (find + verify + everything)

```

* * *

## 🎁 Stuff You Didn’t Ask For (But Will Use)

> **Online Checkers (For the Lazy)**
>
> - [api-guesser.netlify.app](https://api-guesser.netlify.app) — Paste key, auto-detect service
> - [securitytoolkits.com/tools/apikey-validator](https://www.securitytoolkits.com/tools/apikey-validator) — Multi-service web checker
> 
> **Warning:** You’re trusting these sites with secrets. Use for testing/learning only, never production keys.

> **Bug Bounty Playbook**
>
> 1. **Find sus string** → Run through nuclei token-spray
> 2. **Confirmed valid?** → Run `trufflehog analyze` to enumerate permissions
> 3. **Writing report?** → Copy curl command from keyhacks README (shows you know your stuff)
> 4. **Need impact proof?** → dora shows exploitation paths
> 5. **Target has live app?** → keyleak-detector catches runtime secrets
> 
> **Pro tip:** `trufflehog git --include-detectors="AWS,Stripe"` — scan only for specific services when you have a hunch.

> **The Gap Nobody's Filled Yet**
>
> Original Key-Checker:
> 
> ```bash
> ./keychecker --service stripe --key sk_live_xxx
> # ✓ Valid
> 
> ```
> 
> Nothing in 2025 is _exactly_ that simple. Closest:
> 
> - **APIKeyzer** — Right UX, brand new, needs community testing
> - **keyhacks.sh** — Proven, but bash-only
> - **Nuclei** — Most powerful, but requires nuclei installed
> 
> The ecosystem went enterprise-scale instead of “quick check this one thing.” Trade-off everyone accepted. If someone wants to build the perfect lightweight validator, the pieces are all here.

> **Why TruffleHog's Verification Changes Everything**
>
> Most tools: “This _looks like_ an AWS key”  
> TruffleHog: “This _is_ an AWS key, it works, here’s the account ID, and it has S3 + EC2 permissions”
> 
> It literally calls `sts:GetCallerIdentity` for AWS, hits Stripe’s auth endpoint for Stripe keys, etc. 800+ services with real API verification.
> 
> `--only-verified` flag = zero false positives. If it shows up, it’s real.

* * *

## 🔗 Master Link Dump

**Validators (Ranked):**

1. [Nuclei](https://github.com/projectdiscovery/nuclei) + [token-spray templates](https://github.com/projectdiscovery/nuclei-templates/tree/main/http/token-spray)
2. [TruffleHog](https://github.com/trufflesecurity/trufflehog)
3. [keyhacks.sh](https://github.com/gwen001/keyhacks.sh)
4. [APIKeyzer](https://github.com/Xplo8E/APIKeyzer)
5. [apiguesser](https://github.com/daffainfo/apiguesser) + [web](https://api-guesser.netlify.app)
6. [AdvancedKeyHacks](https://github.com/udit-thakkur/AdvancedKeyHacks)
7. [Api-Key-Checker](https://github.com/mahfuz33R/Api-Key-Checker)
8. [dora](https://github.com/sdushantha/dora)
9. [keyleak-detector](https://github.com/Amal-David/keyleak-detector)
10. [Gitleaks](https://github.com/gitleaks/gitleaks)
11. [Nosey Parker](https://github.com/praetorian-inc/noseyparker)

**Pattern Libraries:**

- [secrets-patterns-db](https://github.com/mazen160/secrets-patterns-db) (1,600+ patterns)
- [keyhacks](https://github.com/streaak/keyhacks) (the OG reference)
- [all-about-apikey](https://github.com/daffainfo/all-about-apikey) (150+ services documented)
- [secret-regex-list](https://github.com/h33tlit/secret-regex-list) (Python-ready)
- [PayloadsAllTheThings - API Key Leaks](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/API%20Key%20Leaks/README.md)

**Online Tools:**

- [api-guesser.netlify.app](https://api-guesser.netlify.app)
- [securitytoolkits.com/tools/apikey-validator](https://www.securitytoolkits.com/tools/apikey-validator)

* * *

_Now go check if your own keys leaked. Because someone probably already did._

---

<div class="post-metadata">

**Author:** ![Bob.Smit](https://onehack.st/user_avatar/onehack.st/bob.smit/32/161700_2.png) [@Bob.Smit](https://onehack.st/u/Bob.Smit)\
**Post date:** [January 22, 2026, 8:57pm UTC](https://onehack.st/t/found-a-random-api-key-heres-how-to-know-if-its-treasure-or-trash/317185/2 "2026-01-22T20:57:15Z")

</div>

Another great post from the OG!

---

<div class="post-metadata">

**Author:** ![Emanuel\_Branson](https://onehack.st/user_avatar/onehack.st/emanuel_branson/32/178452_2.png) [@Emanuel\_Branson](https://onehack.st/u/Emanuel_Branson)\
**Post date:** [January 23, 2026, 12:13am UTC](https://onehack.st/t/found-a-random-api-key-heres-how-to-know-if-its-treasure-or-trash/317185/3 "2026-01-23T00:13:32Z")

</div>

Thank you @SRZ for this golden share.

---

<div class="post-metadata">

**Author:** ![king\_khan](https://onehack.st/user_avatar/onehack.st/king_khan/32/117263_2.png) [@king\_khan](https://onehack.st/u/king_khan)\
**Post date:** [January 23, 2026, 2:35am UTC](https://onehack.st/t/found-a-random-api-key-heres-how-to-know-if-its-treasure-or-trash/317185/4 "2026-01-23T02:35:06Z")

</div>

@SRZ Very Useful as usual, would be great, if you can also inlude how these guys created a scanner tool which scan entire github each hour. ?

---

<div class="post-metadata">

**Author:** ![Three\_Deadly\_Sins](https://onehack.st/user_avatar/onehack.st/three_deadly_sins/32/165771_2.png) [@Three\_Deadly\_Sins](https://onehack.st/u/Three_Deadly_Sins)\
**Post date:** [January 23, 2026, 3:10pm UTC](https://onehack.st/t/found-a-random-api-key-heres-how-to-know-if-its-treasure-or-trash/317185/5 "2026-01-23T15:10:09Z")

</div>

W Content! I 😄