TokenPwn: Check If Your LLM API Key Was Leaked

Vectoral Labs has published TokenPwn, a free browser tool that says it can tell you whether an OpenAI, Anthropic, Gemini or other LLM API key appears among "the stolen keys Vectoral sees in the wild, without the key ever leaving your browser." It was announced in early November 2026; Vectoral has not stated an exact launch date. Everything about the dataset and the privacy protocol is Vectoral's own claim: we have not tested it and know of no independent review.

Who this is for: security, platform and engineering leaders whose teams hold LLM API keys, and anyone who has asked how to check whether a key leaked.

Independent analysis based on Vectoral's tool page, its labs and home pages (fetched 4 November 2026) and its launch announcement. Disclosure: Vectoral sells a commercial LLM-fraud scoring platform, and TokenPwn is also a marketing channel for it. PlayCISO has no commercial relationship with Vectoral and was not paid to write this.

What TokenPwn is, and who is behind it

The tool page is titled "TokenPwn: check if your LLM API key has been leaked." It comes from Vectoral Labs, the research arm of Vectoral, which sells an LLM-fraud scoring platform. The tool is free to use and also serves Vectoral as a way to reach people who care about LLM abuse. That does not make it wrong, but it is a reason to read the claims as vendor claims.

Vectoral's launch announcement, a social post and not a page on its site as of 4 November, says "tokens have become currency, and API keys are a one-way ticket to extract them." It also says Vectoral crawls "the darker sides of the internet" and runs a honeypot network. Those are Vectoral's statements about its own operations.

Where Vectoral says the keys come from

1. Honeypots. Decoy LLM proxies that look like misconfigured open gateways. Scanners and key-stuffers offer them stolen keys, and Vectoral keeps a fingerprint of each.
2. Leak monitoring. Public pastes, repositories and reseller channels that Vectoral tracks for research.

The page does not say how many keys either source has produced. See our honeytoken placement planner if you want to plant decoys of your own.

Why a privacy-preserving check matters

A leaked-key checker has an obvious problem: to ask "is this key stolen?" you would normally have to hand over the key. A live API key is a password that also spends money. Pasting one into a website that sees it can turn a safe key into an exposed one, so the habit to keep is: never paste a live key into a site you do not trust to never see it.

Vectoral says it avoids this with an oblivious lookup. The tool page describes four steps:

1. The browser normalises the key and computes a SHA-256 hash.
2. It blinds that fingerprint and runs an oblivious (OPRF) lookup.
3. The server answers the blinded query "without learning the key, its hash or the result."
4. The browser unblinds the answer and checks for a match locally.

An OPRF, or oblivious pseudorandom function, lets a client get a keyed hash of its input from a server without the server seeing the input; it is standardised in RFC 9497. That is a sound building block, but whether TokenPwn uses it correctly is exactly what has not been reviewed in public.

The page and the announcement differ. The launch announcement describes five steps. After the match step it adds that the browser uses the result to pick a bucket, downloads a bucket where "every bucket is exactly the same size, real entries mixed with padding," and matches locally. The tool page lists four steps and does not mention buckets or padding. They may describe the same design at different levels of detail, but we cannot tell which is current.

Why "not found" is not good news

A match tells you a key is in Vectoral's data, which is a reason to act at once. No match tells you only that Vectoral did not see it. Coverage is unknown: we do not know which providers, formats or sources are included, or how fresh the data is. A key leaked in a channel Vectoral does not watch, or leaked this morning, will not appear. Treat "not found" as unknown.

Timeline

What security leaders should do this week

• Rotate any key you believe is exposed, first. Revoke at the provider and issue a replacement. Vectoral's own page says "Rotating is the only fix," and that matches standard practice. Use the Key Rotation Planner to sequence it.
• Look at spend. Check each provider's usage dashboard for unrecognised spend around when the key could have leaked, and set spend alerts and hard limits.
• Find where it leaked. Public repository, client-side bundle, CI log or shared notebook are the places Vectoral lists. Run the Secret Scanner over repos and CI output, and turn on secret scanning in your source host.
• Scope per project. One key per project or service, held server-side, so a leak has a small blast radius and an obvious owner. See Token half-life for how long a leaked token stays useful.
• Do not paste live keys into third-party tools unless you trust the protocol and the operator. If you want to try TokenPwn, understand that you are relying on Vectoral's description of how it works.
• Treat "not found" as unknown and keep your own detection in place.
• Rehearse the response. The Leaked Credential Response tool and the Leaked Cloud Key Lab walk through the first hours.

FAQ

How can I check if my OpenAI API key was leaked?

Providers do not offer a lookup for this, so you work from several signals: check the usage dashboard for spend you do not recognise, search your repositories, CI logs and shared notebooks with a secret scanner, and consider a third-party check such as Vectoral Labs' TokenPwn, which says it matches keys against stolen keys it has seen. A clean result proves little because coverage is unknown. If a key might be exposed, rotate it.

What is TokenPwn?

A free browser tool from Vectoral Labs that says it checks an OpenAI, Anthropic, Gemini or other LLM API key against stolen keys Vectoral sees in the wild, without the key leaving your browser. Vectoral is a vendor of a commercial LLM-fraud scoring platform, and TokenPwn is also a marketing channel for it. PlayCISO has no commercial relationship with Vectoral.

Is TokenPwn safe to use?

We do not know. Vectoral says the key is normalised and hashed in your browser, blinded, and looked up with an oblivious (OPRF) protocol so the server learns neither the key, its hash nor the result. We have not tested that, and we found no independent review. The safest habit is not to paste a live key into any third-party site; if you do test one, treat a key you have pasted anywhere as one you may need to rotate anyway.

What is LLMjacking?

Using stolen LLM API keys or cloud credentials to run models at the victim's expense. The victim pays the bill and may lose quota or have their access used for abusive requests. Vectoral Labs publishes research on the topic; its LLMjacking post is linked under further reading below, and we have not summarised it.

What should I do if an API key leaks?

Revoke it at the provider and issue a replacement, because rotating is the only fix. Then check the provider's usage dashboard for unrecognised spend around when the key could have been exposed, find where it leaked (public repository, client-side bundle, CI log, shared notebook), and move keys server-side with a separate, scoped key per project.

Does a "not found" result in TokenPwn mean my key is safe?

No. Vectoral has not said which providers, key formats or how many keys the dataset covers, or how often it updates. A key that was leaked somewhere Vectoral does not watch would return no match. Treat "not found" as unknown.

Sources

• Vectoral Labs: TokenPwn, check if your LLM API key has been leaked (fetched 4 Nov 2026)
• Vectoral Labs home and research list (fetched 4 Nov 2026)
• Vectoral home page (fetched 4 Nov 2026)
• Vectoral launch announcement for TokenPwn (social post by Vectoral; five-step flow, honeypot and crawling claims)
• RFC 9497: Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups (background on OPRFs; not a review of TokenPwn)
• Further reading: Vectoral: LLMjacking (vendor research; we have not summarised it)

This article is general information, not legal advice. Facts are as stated by Vectoral on 4 November 2026 and may change.