nullcipher

GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_, github_pat_)

ghp_, gho_, ghu_, ghs_ or ghr_ plus 36+ letters and digits, or a github_pat_ fine-grained token. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: GitHub token

What an AI chat would receive after masking

[GITHUB_TOKEN_1]

1 × GitHub token found and masked.

How nullcipher recognises it

ghp_, gho_, ghu_, ghs_ or ghr_ followed by 36 or more letters and digits, or a fine-grained github_pat_ token.

This is the rule text of the “GitHub token” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

ghp_EXAMPLE0000000000000000000000000000abcd

nullcipher replaces it with [GITHUB_TOKEN_1]. The part after ghp_ is the word EXAMPLE padded with zeros. GitHub never issued it.

Why it matters in an AI chat

GitHub puts the token's kind in its prefix: ghp_ is a personal access token (classic), github_pat_ a fine-grained personal access token, gho_ an OAuth access token, ghu_ a user access token for a GitHub App, ghs_ an installation access token for a GitHub App and ghr_ a refresh token for a GitHub App.

A personal access token acts as you, with whatever scopes it was given. A classic token with the repo scope can read and push to every private repository you can.

GitHub automatically revokes a token that is pushed to a public repository or a public gist. An AI chat is neither, so nothing revokes a pasted token for you.

If it already leaked

  1. Personal access token: profile picture → Settings → Developer settings → Personal access tokens → Fine-grained tokens or Tokens (classic), then Delete next to the token. [2]
  2. Token that belongs to a GitHub App or OAuth app: revoking your authorization of that app in your account settings revokes every token associated with it. [3]
  3. GitHub's advice for a leaked secret is to rotate the credential immediately; it notes that removing a secret from Git history is time-intensive and often unnecessary once the credential is revoked. The same logic applies to a chat: revoking beats deleting. [4]
  4. Create a new token with only the scopes and repositories it needs, and set an expiry date on it.

Sources

  1. About authentication to GitHub — GitHub's token formats — checked 2026-09-23.
  2. Managing your personal access tokens — GitHub Docs — checked 2026-09-23.
  3. Token expiration and revocation — GitHub Docs — checked 2026-09-23.
  4. About secret scanning — GitHub Docs — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.