How often should API keys be rotated?

There is no single standard. Cloud access keys are commonly held to 90 days; third-party API keys at least twice a year. Better still, replace long-lived keys with short-lived credentials where the provider supports them.

How do I rotate without downtime?

Create the new secret, deploy it everywhere, confirm the old one is no longer used, then revoke it. Many providers allow two active keys at once for exactly this.

No. It stays in this tab only - export the calendar or spreadsheet to keep it.

Free tool · no account

Secret rotation planner

List the secrets your team depends on, when each was last rotated, and how often it should be. See what is overdue, and export the schedule as calendar reminders or a spreadsheet. Suggested intervals come with the reason behind each one.

Secret 1

Name

Owner

Kind

Last rotated

Rotate every (days, 0 = on events only)

A common baseline for shared machine credentials. Rotate immediately when anyone who knew it leaves.

Secret 2

Name

Owner

Kind

Last rotated

Rotate every (days, 0 = on events only)

The CIS AWS Foundations Benchmark and AWS Security Hub control IAM.3 check that access keys are rotated within 90 days. Better still, replace keys with roles or workload identity.

Secret 3

Name

Owner

Kind

Last rotated

Rotate every (days, 0 = on events only)

No universal standard. Rotate at least twice a year, whenever someone with access leaves, and immediately if it appears anywhere it should not.

Intervals are starting points, not a standard - the reason for each is shown with it. Rotate immediately whenever someone who knew a secret leaves, or it appears anywhere it should not.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Make each rotation one update

Shortspan versions every secret, so a rotation is one update that services pick up on their next shortspan run, with the previous version kept for rollback.

Create a free workspace See what Shortspan does

Where the intervals come from

Some are set by benchmarks: the CIS AWS Foundations Benchmark and AWS Security Hub check that access keys are rotated within 90 days. Some by the platform: publicly trusted TLS certificates have been limited to 200 days since March 2026. NIST SP 800-63B advises against forced periodic changes for passwords people choose. Where there is no standard, the planner says so and gives a sensible default you can change.

Rotation is also event-driven

A schedule catches secrets nobody thought about. Events matter more: rotate immediately when someone who knew a secret leaves, when it appears in a log, a repository, or a chat, and when a laptop that held it is lost.

Common questions

How often should API keys be rotated?: There is no single standard. Cloud access keys are commonly held to 90 days; third-party API keys at least twice a year. Better still, replace long-lived keys with short-lived credentials where the provider supports them.
How do I rotate without downtime?: Create the new secret, deploy it everywhere, confirm the old one is no longer used, then revoke it. Many providers allow two active keys at once for exactly this.
Is my list saved?: No. It stays in this tab only - export the calendar or spreadsheet to keep it.

More free tools