nullcipher

OpenAI API keys (sk-proj-, sk-svcacct-, sk-admin-, legacy sk-)

sk-proj-, sk-svcacct- or sk-admin- plus 20+ characters, or a legacy sk- key of exactly 48 letters and digits. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: OpenAI API key

What an AI chat would receive after masking

[OPENAI_KEY_1]

1 × OpenAI API key found and masked.

How nullcipher recognises it

sk-proj-, sk-svcacct- or sk-admin- followed by at least 20 characters, or a legacy sk- key of exactly 48 letters and digits.

This is the rule text of the “OpenAI API key” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

sk-proj-EXAMPLE_EXAMPLE_EXAMPLE_notarealkey0000

nullcipher replaces it with [OPENAI_KEY_1]. The part after sk-proj- spells EXAMPLE and notarealkey. OpenAI never issued it.

Why it matters in an AI chat

OpenAI's API reference puts it plainly: your API key is a secret; don't share it with others or expose it in client-side code such as browsers or apps. Whoever holds it can make API requests as your project, and that usage is yours.

Project keys start with sk-proj-. Older keys were a bare sk- followed by 48 letters and digits, and nullcipher still recognises that shape because old keys live on in old scripts.

It is the key most often pasted into a chat by accident: inside the very code that calls the API, in a .env file, or in a curl command with an Authorization header.

If it already leaked

  1. Revoke the key on OpenAI's API keys page. OpenAI's API reference says revocations of an API key take effect within a few seconds. OpenAI API keys page. [1]
  2. Create a replacement key and move your applications to it. OpenAI's production guide describes routine rotation as create, update, then revoke the old key once the replacement works; when the old key has leaked, revoke it first and accept a short outage. [2]
  3. Check API key usage for requests you did not make; OpenAI's guide says usage can be monitored per key on the Usage page once tracking is enabled. [2]
  4. Give the new project key an expiration date. OpenAI strongly recommends setting one when you create a project API key, and a regular rotation process. [2]

Sources

  1. API Overview — OpenAI API reference — checked 2026-09-23.
  2. Production best practices — OpenAI API docs — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.