nullcipher

Private key blocks (-----BEGIN … PRIVATE KEY-----)

The whole BEGIN … END block of an SSH, TLS, PGP or PKCS#8 private key. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Private key

What an AI chat would receive after masking

[PRIVATE_KEY_1]

1 × Private key found and masked.

How nullcipher recognises it

A whole -----BEGIN … PRIVATE KEY----- to -----END … PRIVATE KEY----- block (RSA, EC, DSA, OpenSSH, PKCS#8, encrypted, PGP) becomes one placeholder.

This is the rule text of the “Private key block” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

-----BEGIN OPENSSH PRIVATE KEY-----
EXAMPLEEXAMPLEEXAMPLEnotarealkeyEXAMPLEEXAMPLEEXAMPLE
EXAMPLEEXAMPLEEXAMPLEnotarealkeyEXAMPLEEXAMPLEEXAMPLE
-----END OPENSSH PRIVATE KEY-----

nullcipher replaces it with [PRIVATE_KEY_1]. The body is the word EXAMPLE repeated. It is not a key and no SSH client would load it.

Why it matters in an AI chat

A private key is the half of a key pair that proves who you are. Whoever holds it can log in to every server that trusts the matching public key, sign commits or releases as you, or decrypt what was encrypted to you.

There is usually nothing else in front of it: no second factor, no rate limit. An encrypted key is only as safe as its passphrase, and an unencrypted one is safe only as long as nobody else has seen the text.

Keys end up in chats inside pasted config dumps, CI logs, Kubernetes secrets and deployment scripts, often next to the host name they unlock.

If it already leaked

  1. Make a new key pair on your own machine (for SSH, for example ssh-keygen -t ed25519) and install the new public key wherever the old one was trusted.
  2. Remove the old public key from every place that trusts it: ~/.ssh/authorized_keys on servers, SSH and deploy-key settings on code hosts, and any cloud console it was uploaded to. Until it is removed, the leaked private key still opens those doors.
  3. On GitHub: profile picture → Settings → SSH and GPG keys, then Delete next to the old key. GitHub's guide says to delete any SSH key you do not recognise immediately and to contact GitHub Support for further help. [1]
  4. If it was the key behind a TLS certificate, ask the certificate authority that issued the certificate to revoke it, and get a new certificate for the new key.

Sources

  1. Reviewing your SSH keys — GitHub Docs — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.