nullcipher

PyPI API tokens (pypi-AgEIcHlwaS5vcmc…)

pypi-AgEIcHlwaS5vcmc followed by at least 50 letters, digits, dashes or underscores. The fixed part is base64 for the token's issuer, pypi.org. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: PyPI upload token

What an AI chat would receive after masking

# EXAMPLE .pypirc, not a real token
[pypi]
username = __token__
password = [PYPI_UPLOAD_TOKEN_1]

1 × PyPI upload token found and masked.

How nullcipher recognises it

Checked only when the text contains “pypi-ageichlwas5vcmc” (any case). Pattern (gitleaks rule pypi-upload-token, v8.30.1, translated to JavaScript): /pypi-AgEIcHlwaS5vcmc[\w\-]{50,1000}/ — the whole match is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 3 bits per character, so repetitive placeholders like xxxx are left alone.

This is the rule text of the “PyPI upload token” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

# EXAMPLE .pypirc, not a real token
[pypi]
username = __token__
password = pypi-AgEIcHlwaS5vcmcEXAMPLE_not_a_real_token_EXAMPLE_not_a_real_token_EXAMPLE

nullcipher replaces it with [PYPI_UPLOAD_TOKEN_1]. Everything after the fixed pypi-AgEIcHlwaS5vcmc prefix is the phrase EXAMPLE_not_a_real_token. PyPI never issued it.

Why it matters in an AI chat

PyPI API tokens authenticate package uploads: PyPI's help says to use __token__ as the user name and the whole token, including the pypi- prefix, as the password. A token scoped to your whole account can upload a new release of every project you own; a project-scoped token, one project.

A malicious release published with a stolen token reaches everyone who runs pip install without a pinned version — the classic Python supply-chain attack.

PyPI automatically revokes tokens that are posted on public websites and e-mails you about it. A private AI chat is not public, so that safety net does not apply here.

If it already leaked

  1. Remove the token: in your PyPI account settings, go to the API tokens section (where tokens are created) and remove the leaked one. Uploads that used it then fail with PyPI's invalid-authentication error. [1]
  2. Before creating a replacement, PyPI's help for compromised tokens says to try to determine how it leaked, and its suspicious-activity advice applies: check your projects' release history for uploads you did not make. [1]
  3. Consider replacing the token altogether with Trusted Publishing, where CI exchanges a short-lived OIDC token with PyPI and no long-lived upload token exists to leak. [2]

Sources

  1. Help — PyPI (API tokens; compromised API tokens) — checked 2026-09-25.
  2. Trusted Publishers — PyPI Docs — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.