Free tool
Has your API key
been pwned?
TokenPwn checks an OpenAI, Anthropic, Gemini or other LLM API key against the stolen keys Vectoral sees in the wild, without the key ever leaving your browser.
Where the data comes from
- Honeypots
- Decoy LLM proxies that look like misconfigured, open gateways. Scanners and key-stuffers offer them stolen keys; we keep a fingerprint of each one, never the key.
- Leak monitoring
- Keys exposed in public pastes, repositories and the reseller channels we track for our research.
If your key shows up
Revoke it at the provider and issue a replacement. Rotating is the only fix.
Check the provider's usage dashboard for spend you do not recognise around the first-seen date.
Find where it leaked: a public repo, a client-side bundle, a CI log, a shared notebook.
Move keys server-side and scope them per project, so the next leak is smaller.