Secrets and credentials (passwords, keys, tokens)
Category ID secrets · 71 types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| access_token | Access token draft | secrets | global | Bearer token that grants access to an API on behalf of a user or an application, such as an OAuth 2.0 access or refresh token or a... |
| age_secret_key | age secret key (X25519 identity) draft | secrets, cryptography | global | Secret key (identity) of the age file encryption format and tool, which decrypts files encrypted to the matching age1... public key. It... |
| anthropic_api_key | Anthropic API key draft | secrets | global | Secret key of the Anthropic (Claude) API, sent in the x-api-key header. Standard keys start with sk-ant-api03- and Admin API keys, which... |
| api_key | API key or client secret draft | secrets | global | Secret string that an application presents to an API or an identity provider to authenticate itself, such as an API key, a subscription... |
| argon2_hash | Argon2 password hash (PHC string) draft | secrets, cryptography | global | Password hash of Argon2 (RFC 9106), the winner of the Password Hashing Competition, in the PHC string format: $argon2id$ (or argon2i,... |
| atlassian_api_token | Atlassian API token draft | secrets | global | API token of an Atlassian account (Jira, Confluence and other Atlassian cloud products). Current tokens start with ATATT3; secret... |
| aws_access_key_id | AWS access key ID draft | secrets | global | Public half of an Amazon Web Services access key pair, sent with every signed API request together with the secret access key. It has 20... |
| aws_secret_access_key | AWS secret access key draft | secrets | global | Secret part of an Amazon Web Services access key pair, used with the access key ID to sign API requests (for example to Amazon S3): 40... |
| azure_storage_account_key | Azure Storage account key draft | secrets | global | Access key of an Azure Storage account: 512 bits encoded in Base64, which gives 86 characters followed by two equals signs. |
| bcrypt_hash | bcrypt password hash draft | secrets, cryptography | global | Password hash produced by bcrypt in Modular Crypt Format: $2, an optional version letter (a, b, x or y), $, a two-digit cost, $ and 53... |
| bip32addr | BIP-32 extended key (xpub, xprv) | cryptocurrency, secrets | global | Extended public or private key of a hierarchical deterministic (HD) wallet in the serialization of BIP-32: 4 version bytes, depth,... |
| bip39_mnemonic | BIP-39 mnemonic phrase (seed phrase) draft | cryptocurrency, secrets | global | Recovery phrase of a cryptocurrency wallet as defined by BIP 39: 12, 15, 18, 21 or 24 words from a fixed list of 2048 words, where the... |
| cloudflare_origin_ca_key | Cloudflare Origin CA key draft | secrets | global | Key for the Cloudflare Origin CA certificates API, often sent in the X-Auth-User-Service-Key header and also used by the Keyless SSL key... |
| connection_string | Connection string with credentials draft | secrets | global | Connection string of a database or a cloud service that includes a password or an access key, for example Server=...;User... |
| databricks_access_token | Databricks personal access token draft | secrets | global | Personal access token of Databricks, used to authenticate to a Databricks workspace. It starts with dapi followed by 32 hexadecimal... |
| digitalocean_token | DigitalOcean API token draft | secrets | global | API token of DigitalOcean. The prefix tells the token type: dop_v1_ for a personal access token, doo_v1_ for an OAuth access token and... |
| doppler_token | Doppler token draft | secrets | global | Access token of the Doppler secrets manager. Doppler documents one format per token type, each starting with dp. and a type code: dp.pt.... |
| dynatrace_token | Dynatrace token draft | secrets | global | Access token of Dynatrace in the format used since Dynatrace version 1.210: a prefix that names the token type (dt0 followed by a letter... |
| facebook_app_access_token | Facebook app access token draft | secrets | global | App access token of the Meta (Facebook) Graph API written as the app ID, a vertical bar and the app secret. Meta allows this form in... |
| github_fine_grained_pat | GitHub fine-grained personal access token draft | secrets | global | Fine-grained personal access token of GitHub, limited to selected repositories and permissions: github_pat_ followed by 82 letters,... |
| github_token | GitHub token draft | secrets | global | Token issued by GitHub, such as a personal access token. It starts with a prefix that names the token type (ghp_, gho_, ghu_, ghs_ or... |
| gitlab_pat | GitLab personal access token draft | secrets | global | Personal access token of GitLab, which authenticates a user to the GitLab API and to Git over HTTPS. GitLab gives these tokens the... |
| google_api_key | Google API key draft | secrets | global | API key for Google Cloud and Google Maps APIs: the prefix AIza followed by 35 letters, digits, hyphens or underscores. |
| grafana_service_account_token | Grafana service account token draft | secrets | global | Token of a Grafana service account, sent as a bearer token to the Grafana HTTP API: glsa_ followed by 32 letters and digits, an... |
| hashicorp_vault_token | HashiCorp Vault token draft | secrets | global | Token that authenticates a client to HashiCorp Vault. Since Vault 1.10 the prefix names the token type - hvs. for service tokens, hvb.... |
| heroku_oauth_token | Heroku API OAuth access token draft | secrets | global | OAuth access token of the Heroku Platform API, which the Heroku CLI also uses. Tokens granted from April 2024 start with HRKU-: until... |
| http_authorization_header | HTTP Authorization header value draft | secrets | global | Value of the HTTP Authorization request header: an authentication scheme such as Basic, Bearer, Digest or Negotiate followed by the credentials. |
| huggingface_access_token | Hugging Face access token draft | secrets | global | User access token of the Hugging Face Hub, used in place of a password for git, as a bearer token for Inference Providers and in the... |
| jfrog_api_key | JFrog Artifactory API key draft | secrets | global | Deprecated API key of JFrog Artifactory: the prefix AKCp followed by 69 letters and digits (the format that the gitleaks secret scanner... |
| jfrog_reference_token | JFrog reference token draft | secrets | global | Short token of the JFrog Platform (Artifactory) that refers to a full JWT access token. It has 64 characters: the prefix cmVmd followed... |
| jwt | JSON Web Token (JWT) draft | secrets | global | Compact JSON Web Token (RFC 7519) signed with JWS: three Base64url parts (header, claims and signature) separated by dots. The header... |
| linear_api_key | Linear API key draft | secrets | global | Personal API key of Linear, the issue tracking service: lin_api_ followed by 40 letters and digits. |
| mailchimp_api_key | Mailchimp API key draft | secrets | global | API key of the Mailchimp Marketing API: 32 hexadecimal digits, a hyphen and the data center of the account (for example us6), which is... |
| md5crypt_hash | MD5-crypt password hash draft | secrets, cryptography | global | Password hash of the MD5-based crypt scheme of FreeBSD, in Modular Crypt Format: $1$, a salt of up to 8 characters, $ and 22 characters... |
| new_relic_user_api_key | New Relic user key draft | secrets | global | User key of New Relic, a personal API key that NerdGraph, New Relic's GraphQL API, requires for querying data and changing... |
| npm_access_token | npm access token draft | secrets | global | Access token of the npm package registry in the format introduced in 2021: the prefix npm_ followed by 36 letters and digits, the last... |
| onepassword_service_account_token | 1Password service account token draft | secrets | global | Token of a 1Password service account. 1Password gives it the prefix ops_ so that code analyzers can find it; the rest is a... |
| openai_api_key | OpenAI API key draft | secrets | global | Secret key of the OpenAI API. Keys start with sk-; project, service account and admin keys start with sk-proj-, sk-svcacct- or... |
| pgp_private_key_block | OpenPGP private key block draft | secrets, cryptography | global | OpenPGP secret key in ASCII armor: Radix-64 text between the lines -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY... |
| planetscale_password | PlanetScale database password draft | secrets | global | Password of a PlanetScale database: pscale_pw_ followed by 32 to 64 letters, digits and the characters _ = . -. |
| planetscale_token | PlanetScale API token draft | secrets | global | Token for the PlanetScale API and CLI: a service token starts with pscale_tkn_ and an OAuth token with pscale_oauth_. Secret scanners... |
| postman_api_key | Postman API key draft | secrets | global | API key of the Postman API, sent in the X-API-Key header: PMAK- followed by 24 hexadecimal digits, a hyphen and 34 more hexadecimal digits. |
| private_key | Private key or wallet seed (generic) draft | secrets, cryptocurrency, cryptography | global | Secret key of an asymmetric key pair, or the seed or mnemonic phrase from which a cryptocurrency wallet derives its keys. Whoever knows... |
| pulumi_access_token | Pulumi access token draft | secrets | global | Access token of Pulumi Cloud (a personal, organization or team token): pul- followed by 40 hexadecimal digits. |
| pypi_token | PyPI API token draft | secrets | global | API token of the Python Package Index, used to upload packages. It is a serialized macaroon with the prefix pypi-; PyPI documents that... |
| rubygems_api_key | RubyGems API key draft | secrets | global | API key of RubyGems.org, used by the gem CLI to push and manage gems, for example through the GEM_HOST_API_KEY environment variable:... |
| sendgrid_api_key | SendGrid API key draft | secrets | global | API key of Twilio SendGrid, also used as the SMTP password. Keys are always 69 characters long and start with SG. followed by letters,... |
| sendinblue_api_key | Sendinblue API key draft | secrets | global | API key of the Sendinblue email marketing service: xkeysib- followed by 64 hexadecimal digits, a hyphen and 16 letters and digits. |
| sentry_auth_token | Sentry auth token draft | secrets | global | Auth token of Sentry, the error monitoring service. Personal (user) tokens are sntryu_ followed by 64 hexadecimal digits. Organization... |
| sha256crypt_hash | SHA-256-crypt password hash draft | secrets, cryptography | global | Password hash of the SHA-256-based crypt scheme by Ulrich Drepper, in Modular Crypt Format: $5$, an optional rounds=N$ (5000 rounds by... |
| sha512crypt_hash | SHA-512-crypt password hash draft | secrets, cryptography | global | Password hash of the SHA-512-based crypt scheme by Ulrich Drepper, in Modular Crypt Format: $6$, an optional rounds=N$ (5000 rounds by... |
| shared_access_signature | Azure shared access signature (SAS) draft | secrets | global | Shared access signature of Azure services (Storage, Service Bus, Logic Apps): a URL query string with permissions, an expiry time and a... |
| shopify_access_token | Shopify access token draft | secrets | global | Access token of a Shopify app. The prefix tells the kind of token: shpat_ for an app access token, shpca_ for a custom app and shppa_... |
| shopify_shared_secret | Shopify app shared secret draft | secrets | global | Shared secret of a Shopify app: the prefix shpss_ followed by 32 hexadecimal digits. |
| slack_token | Slack token draft | secrets | global | Access token of the Slack API. The prefix names the token type, for example xoxb- for bot tokens and xoxp- for user tokens. |
| slack_webhook_url | Slack incoming webhook URL draft | secrets | global | URL of a Slack incoming webhook or workflow trigger on hooks.slack.com. Anyone who knows the URL can post messages to the channel, so... |
| sonarqube_token | SonarQube token draft | secrets | global | Token of SonarQube Server used to run an analysis or call the web API instead of a login and password. Current tokens start with one of... |
| square_access_token | Square access token draft | secrets | global | Personal or OAuth access token of the Square APIs. Square does not document the format; secret scanners such as gitleaks recognize it by... |
| square_oauth_secret | Square OAuth application secret draft | secrets | global | Application secret of a Square developer application, which the application uses to exchange OAuth authorization codes for access... |
| stripe_api_key | Stripe secret or restricted API key draft | secrets | global | Server-side API key of Stripe. Secret keys start with sk_ and restricted keys with rk_, followed by test_ for a sandbox or live_ for... |
| symmetric_key | Symmetric secret key draft | secrets | global | Secret key of a symmetric algorithm or a shared access key, usually written in Base64 or hexadecimal, for example a 256-bit key as 43... |
| telegram_bot_token | Telegram bot token draft | secrets | global | Token that authorizes a bot in the Telegram Bot API: the numeric bot ID, a colon and a secret that starts with A. Telegram documents the... |
| terraform_cloud_api_token | HashiCorp Terraform Cloud API token draft | secrets | global | User or organization API token of HashiCorp Terraform Cloud: 14 letters and digits, the marker .atlasv1. and 60 to 70 more letters,... |
| twilio_api_key_sid | Twilio API key SID draft | secrets | global | String identifier (SID) of a Twilio API key: SK followed by 32 hexadecimal digits. The SID is used together with the API key secret as... |
| unix_shadow_entry | Unix shadow password file entry PII draft | secrets | global | One line of /etc/shadow on Linux and other Unix systems: nine colon-separated fields with the login name, the hashed password (or ! or *... |
| uri_with_password | URI with embedded password PII draft | secrets, internet | global | URI whose user information part contains a password, as in scheme://user:password@host/. RFC 3986 deprecates this form, but database and... |
| user_credentials | User login credentials PII draft | secrets | global | A user name and a password written together, for example in a configuration file, a command line or a script. |
| wifaddrcomp | Bitcoin private key in WIF (compressed public key) | cryptocurrency, secrets | global | Bitcoin private key in Wallet Import Format (WIF) for a compressed public key: the Base58Check encoding of the byte 0x80, the 32-byte... |
| wifaddruncomp | Bitcoin private key in WIF (uncompressed public key) | cryptocurrency, secrets | global | Bitcoin private key in Wallet Import Format (WIF) for an uncompressed public key: the Base58Check encoding of the byte 0x80 and the... |
| x509_private_key | X.509 certificate private key draft | secrets, cryptography | global | Private key of an X.509 certificate, usually written as a PEM block that starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY, EC... |
| yescrypt_hash | yescrypt password hash draft | secrets, cryptography | global | Password hash of yescrypt, the scrypt-based scheme by Openwall that is the default in /etc/shadow on recent releases of Debian, Ubuntu... |