Is an access key ID secret?

Not on its own - it identifies a key, like a user name. The secret access key is what signs requests. But an exposed ID often travels with its secret, so check where it came from.

What should I do with a leaked AKIA key?

Deactivate it in IAM, review CloudTrail for what it was used for, delete it, and issue a replacement - or better, move the workload to an IAM role so there is no long-term key to leak.

Does decoding the account contact AWS?

No. The decoding is arithmetic in your browser. Only the `aws sts get-access-key-info` command, if you choose to run it, talks to AWS.

Free tool · no account

AWS access key ID decoder

Found an AWS key ID in a log, a repository, or a ticket? Paste it to see whether it is a long-term or temporary key - or an IAM user, role, or policy ID - and, for access keys, which AWS account issued it. Only the ID is needed, never the secret key.

Access key ID or IAM unique ID

The ID only (AKIA…, ASIA…, AROA…). Never paste the secret access key.

Prefixes AWS documents

AKIA Access key (long-term)
ASIA Temporary access key (AWS STS)
ABIA AWS STS service bearer token
ACCA Context-specific credential
AGPA User group
AIDA IAM user
AIPA Amazon EC2 instance profile
ANPA Managed policy
ANVA Version in a managed policy
APKA Public key
AROA Role
ASCA Certificate

Paste an AWS access key ID or IAM unique ID to see what it is and, for access keys, which account it belongs to.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Keep AWS keys off laptops

Shortspan stores AWS keys encrypted and releases them into a single subshell with shortspan aws, so they never sit in ~/.aws/credentials - and every release is recorded against a person.

Create a free workspace See what Shortspan does

What the prefix tells you

AWS identifiers start with four letters that name what they are. AKIA is a long-term access key that works until someone deactivates it. ASIA is a temporary key from AWS STS that only works with its session token and expires. AIDA, AROA, and ANPA are the unique IDs of users, roles, and managed policies - not credentials at all.

Finding the account

The account number is encoded in the access key ID itself. The decoding was published by security researchers Aidan Steele and Tal Be’ery: base32-decode the characters after the prefix and read the account from the leading bits. This page does that locally.

AWS’s own answer is aws sts get-access-key-info, which the tool gives you to run. It is recorded in your account’s CloudTrail, not in the account that owns the key.

Common questions

Is an access key ID secret?: Not on its own - it identifies a key, like a user name. The secret access key is what signs requests. But an exposed ID often travels with its secret, so check where it came from.
What should I do with a leaked AKIA key?: Deactivate it in IAM, review CloudTrail for what it was used for, delete it, and issue a replacement - or better, move the workload to an IAM role so there is no long-term key to leak.
Does decoding the account contact AWS?: No. The decoding is arithmetic in your browser. Only the aws sts get-access-key-info command, if you choose to run it, talks to AWS.

More free tools