nullcipher

Azure AD / Microsoft Entra ID client secrets (…8Q~…)

Three characters, a digit, Q~ and 31 to 34 more letters, digits, dots, dashes, underscores or tildes — the shape of an Entra ID app registration's client secret value. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Azure AD client secret

What an AI chat would receive after masking

# EXAMPLE, not a real secret
AZURE_CLIENT_SECRET=[AZURE_AD_CLIENT_SECRET_1]

1 × Azure AD client secret found and masked.

How nullcipher recognises it

Checked only when the text contains “q~” (any case). Pattern (gitleaks rule azure-ad-client-secret, v8.30.1, translated to JavaScript): /(?:^|[\s"'-),:=>\\`])([.0-9A-Z_a-z~]{3}\dQ~[\-.0-9A-Z_a-z~]{31,34})(?:$|[\s"'),<\\`])/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 3 bits per character, so repetitive placeholders like xxxx are left alone.

This is the rule text of the “Azure AD (Entra ID) client secret” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

# EXAMPLE, not a real secret
AZURE_CLIENT_SECRET=EXa8Q~EXAMPLEexampleEXAMPLEexample000000

nullcipher replaces it with [AZURE_AD_CLIENT_SECRET_1]. Built to the pattern around the word EXAMPLE. Microsoft never issued it.

Why it matters in an AI chat

A client secret is the password of an app registration: with it and the app's (public) client ID and tenant ID, anyone can sign in as the application and get every Microsoft Graph or Azure permission the app was granted — often mailbox, SharePoint or subscription access that no single user has.

Microsoft's guidance is that client secrets are less secure than certificates or federated credentials and should not be used in production; a secret's lifetime is capped at 24 months, and Microsoft recommends under 12.

Secrets are pasted into AI chats inside appsettings.json, .env files and MSAL sample code when sign-in fails.

If it already leaked

  1. Delete the secret: in the Microsoft Entra admin center open App registrations → your app → Certificates & secrets → Client secrets, and delete the leaked one. Add a new one there (or better, a certificate) and update the app. [1]
  2. From the command line: az ad app credential delete --id <app-id> --key-id <key-id> deletes an application's password credential; az ad app credential list shows the key IDs. [2]
  3. From code or automation: Microsoft Graph's application: removePassword removes a password from an application. [3]

Sources

  1. Add and manage application credentials in Microsoft Entra ID — Microsoft Learn — checked 2026-09-25.
  2. az ad app credential — Azure CLI reference — Microsoft Learn — checked 2026-09-25.
  3. application: removePassword — Microsoft Graph v1.0 — Microsoft Learn — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.