Google API keys (AIza…)

How nullcipher recognises it

AIza followed by exactly 35 letters, digits, dashes or underscores.

This is the rule text of the “Google API key” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

AIzaSyEXAMPLE-EXAMPLE_EXAMPLE-EXAMPLE00

nullcipher replaces it with [GOOGLE_API_KEY_1]. AIza, then Sy, then the word EXAMPLE repeated to make up the length. Google never issued it.

Why it matters in an AI chat

A Google Cloud API key identifies your project to Google's APIs. Whoever holds it can call any API the key is allowed to call, and the usage counts against your project's quota and bill.

Google's own documentation says unrestricted API keys are insecure. A key with no API restrictions and no website, IP address or app restrictions works from anywhere.

Keys like this sit in Android and web front-end code, in Firebase config and in scripts, so they are pasted into chats far more often than people notice.

If it already leaked

1. In the Google Cloud console, go to the Credentials page and click the name of the key, then click Rotate key. ^[1]
2. Give the new key a name, confirm its restrictions are correct, copy the new key string and update your applications to use it. ^[1]
3. When every application uses the new key, return to the new key's details page and click Delete the previous key in the Previous key section. ^[1]
4. Add API restrictions (which APIs the key may call) and application restrictions (which websites, IP addresses or Android/iOS apps may use it), so the next leak is worth less. ^[1]

Sources

1. Manage API keys — Authentication — Google Cloud Documentation — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.