nullcipher

Hugging Face access tokens (hf_…)

hf_ followed by exactly 34 letters (a User Access Token), or api_org_ followed by 34 letters (a legacy organization token). Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Hugging Face token

What an AI chat would receive after masking

# EXAMPLE, not a real token
HF_TOKEN=[HUGGINGFACE_ACCESS_TOKEN_1]

1 × Hugging Face token found and masked.

How nullcipher recognises it

Checked only when the text contains “hf_” (any case). Pattern (gitleaks rule huggingface-access-token, v8.30.1, translated to JavaScript): /\b(hf_(?:[A-Za-z]{34}))(?:[\s"';`]|\\[nr]|$)/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone.

This is the rule text of the “Hugging Face access token” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

The same page covers 1 more rule, each with its own placeholder:

Hugging Face organization API token — [HUGGINGFACE_ORGANIZATION_API_TOKEN_1]
Checked only when the text contains “api_org_” (any case). Pattern (gitleaks rule huggingface-organization-api-token, v8.30.1, translated to JavaScript): /\b(api_org_(?:[A-Za-z]{34}))(?:[\s"';`]|\\[nr]|$)/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 2 bits per character, so repetitive placeholders like xxxx are left alone. (gitleaks rule)

Example (fake)

# EXAMPLE, not a real token
HF_TOKEN=hf_EXAMPLEtokenNotRealDoNotUseQwertyZ

nullcipher replaces it with [HUGGINGFACE_ACCESS_TOKEN_1]. The 34 letters after hf_ read EXAMPLE token Not Real Do Not Use. Hugging Face never issued it.

Why it matters in an AI chat

Hugging Face's documentation warns that anyone holding a leaked token can read or write your private repositories until you rotate it: private models, datasets and Spaces, and with a write token, push changes to them.

A token also bills Inference Providers calls to your account, since it is passed as the bearer token for those requests.

Tokens are pasted into AI chats inside notebooks and training scripts (the token= argument of from_pretrained), which is exactly what people ask an assistant to debug.

If it already leaked

  1. Your own token: open Settings → Access Tokens and delete or refresh it with the Manage button. Hugging Face's section on revoking a leaked token says exactly this. [1]
  2. Someone else's token you came across: Hugging Face provides a POST /api/credentials/revoke endpoint that invalidates a token without needing any rights over the account that owns it. [1]
  3. Hugging Face recommends one token per app or machine and fine-grained tokens for production, so the next leak can be revoked without breaking everything else. [1]

Sources

  1. User access tokens — Hugging Face Hub docs — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.