Skip to main content

Base64 Generic high entropy secret



The base64 generic high entropy detector aims at catching any high entropy strings being assigned to a sensitive variable in base64-encoded text. It is applying similar validation steps and specifications as the generic high entropy detector but adapts them to be applied in base64-encoded text.


About Base64-encoded text

Base64 is a binary-to-text encoding scheme. It is mainly used to send binary data across channels that only reliably support text content. Base64 is also applied on text, for example in JSON Web Token or to obfuscate it.

Base64 is not an encryption algorithm, encoding and decoding do not rely on a secret key but Base64 is commonly used to encode to text the results of encryption algorithms. This detector will only look for generic secrets inside Base64 encoded-text representing unicode text.

Revoke the secret

This detector catches generic secrets, hence GitGuardian cannot infer the concerned service. To properly revoke the secret :

  1. Understand what service is impacted. Decoding the whole Base64 text may be required.
  2. Refer to the corresponding documentation to know how to revoke and rotate the secret.


Examples that WILL be caught

# base64(api_key = rca.pibsaorcibu234lbu43)
- text: |
apikey: HJjYS5waWJzYW9yY2lidTIzNGxidTQz

# base64({"api-key": "asnbtueaorueobu435nstau"})
- text: |
apikey: mFzbmJ0dWVhb3J1ZW9idTQzNW5zdGF1

# base64(token: asnbtueaorueobu435nstau)
- text: |
apikey: GFzbmJ0dWVhb3J1ZW9idTQzNW5zdGF1

# base64(authorization = asnbtueaorueobu435nstau)
- text: |
apikey: GFzbmJ0dWVhb3J1ZW9idTQzNW5zdGF1

Examples that WILL NOT be caught

  • The high entropy string is too short :
# base64(api_key = hj65_klhz/trlu)
- text: |
  • The entropy of the string is not high enough
# base64(secret = xob1xob1xob1xob1xob1xob1xob1)
- text: |
  • The assigned variable is not considered sensitive
# base64(object_id = hj65_klhz/trlupok76)
- text: |

For more examples, see the examples of the generic high entropy detector encoded in Base64 [.

Details for Base64 Generic high entropy secret

  • High Recall: False

  • Validity Check: False

  • Minimum Number of Matches: 1

  • Occurrences found for one million commits: 70

  • Prefixed: False

  • PreValidators:
    Here is a list of the validation steps the document must pass before being analyzed.

- type: FilenameBanlistPreValidator
banlist_extensions: []
- hash
- list/k.txt$
- list/plex.txt$
- \.csproj$
- tg/mtproto\.json
check_binaries: false
- type: ContentWhitelistPreValidator
- '[a-z0-9+/]{28,10000}={0,2}'
- type: Base64ContentWhitelistPreValidator
- secret
- token
- apikey
- api-key
- api_key
- api.key
- credential
- auth

How can I help you ?