nullcipher

AWS access key IDs (AKIA… and ASIA…)

AKIA or ASIA plus 16 upper-case letters or digits, 20 characters in all. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: AWS access key ID

What an AI chat would receive after masking

[AWS_KEY_1]

1 × AWS access key ID found and masked.

How nullcipher recognises it

AKIA (long-term) or ASIA (temporary) followed by exactly 16 upper-case letters or digits.

This is the rule text of the “AWS access key ID” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

AKIAIOSFODNN7EXAMPLE

nullcipher replaces it with [AWS_KEY_1]. This is the example access key ID AWS prints in its own IAM documentation. It ends in EXAMPLE and belongs to no account.

Why it matters in an AI chat

An access key ID is half of an AWS credential. The other half is a 40-character secret access key, and AWS's documentation says the two are used together to sign requests. The ID alone does not grant access, but a pasted .env file or credentials file almost always has the secret on the next line.

Long-term keys (AKIA…) do not expire on their own. AWS's own warning is that handing your keys to someone else "might give someone permanent access to your account", and a cloud account can run up a bill quickly.

Temporary keys (ASIA…) come from roles and sessions and expire, but until they do they carry the same permissions as the role that issued them.

If it already leaked

  1. Sign in to the IAM console, choose Users, open the user and go to the Security credentials tab. In Access keys, choose Create access key to make a second key while the first is still active. [1]
  2. Update every application and tool that used the old key to use the new one. [1]
  3. Deactivate the old key (Actions → Deactivate). Anything still using it stops working at this point, which tells you what you missed; AWS lets you reactivate it while you fix that. [1]
  4. Delete the old key (Actions → Delete). From the AWS CLI the same sequence is aws iam create-access-key, aws iam update-access-key (set the old key to Inactive) and aws iam delete-access-key. [1]
  5. AWS's rotation guide suggests waiting days before deleting an unused key; that pace suits routine rotation. For a key that has leaked, every hour between creating the new key and deactivating the old one is time someone else can use it, so move through the steps as fast as your applications allow.
  6. Check the old key's Last used information, and use AWS CloudTrail, which AWS recommends for spotting unauthorised use of an access key, to see whether anyone else used it. [1][2]

Sources

  1. Update access keys — AWS Identity and Access Management User Guide — checked 2026-09-23.
  2. Manage access keys for IAM users — AWS Identity and Access Management User Guide — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.