Start free
FREE TOOL

AWS Access Key ID Decoder

Decode an AWS access key ID to its account number and key type, and fix credential errors such as "The security token included in the request is invalid".

  • Your data never leaves your browser: everything is calculated by JavaScript on this page, not on a server.
  • Nothing you enter is uploaded, processed on a server or stored. Check it in your browser's developer tools (Network tab).
  • Once the page has loaded, the tool works without an internet connection.

Key ID or error message

An access key ID (AKIA..., ASIA...), an IAM unique ID (AIDA..., AROA...), an error from the AWS CLI or an SDK - or all of it at once, straight from the terminal. Never the secret access key.

Or pick an error

The credential errors the decoder recognizes, with their causes and fixes.

Key ID format →All credential errors →
See result ↓
Access keys, temporary credentials and IAM roles are core AWS Security Specialty topicsTry free SCS-C02 practice questions with answers and explanations.SCS-C02 questions →

AWS access key ID format

An access key ID is 20 characters long: a four-letter prefix and 16 uppercase letters and digits, for example AKIARZPUZDIKAEXAMPLE. It is the public half of an access key; the secret access key, 40 characters, is the half that signs requests and is never needed to identify a key. The prefix tells what the ID belongs to - IAM uses the same scheme for the unique IDs of users, roles and other resources:

PrefixWhat it is
AKIALong-term access key of an IAM user or the root user
ASIATemporary access key from AWS STS - a role, SSO, a federated or session user; works only with its session token
AIDAIAM user
AROAIAM role
AGPAIAM user group
AIPAAmazon EC2 instance profile
ANPAManaged policy
ANVAVersion in a managed policy
APKAPublic key
ASCACertificate
ABIAAWS STS service bearer token
ACCAContext-specific credential

Unique IDs such as AIDA... and AROA... appear in aws sts get-caller-identity (UserId), in CloudTrail events and in policies' aws:userid conditions. A user or role created again with a deleted one's name gets a new ID.

Finding the AWS account of an access key

Access keys in the current format, used for keys created in recent years, carry the number of the account they belong to: the characters after the prefix are base32, and 40 of the bits they encode are the account number. The decoder reads it without calling AWS. Keys in the older format - their fifth character is I or J, like the documentation's AKIAIOSFODNN7EXAMPLE - do not carry it. For any key, AWS itself answers, with credentials of any account: 

aws sts get-access-key-info --access-key-id AKIARZPUZDIKAEXAMPLE

To see which user or role your own credentials belong to, use aws sts get-caller-identity. When a key ID turns up in a log or a leak, the account tells whose it is; the key itself still has to be deactivated by that account's owner.

AWS credential errors and how to fix them

Most credential errors come down to the CLI or SDK using different credentials than you think. Before anything else, ask it: 

aws configure list          # which key, profile and Region are used, and where each comes from
aws sts get-caller-identity # which account and user or role the credentials belong to
env | grep AWS_             # environment variables override every profile

The credential chain is searched in this order, and the first source that has credentials wins: command line options, environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), the profile in ~/.aws/credentials and ~/.aws/config (including SSO and assumed roles), then container credentials and the EC2 instance role.

ErrorMost common cause
The security token included in the request is invalidDeleted or mistyped access key, or a session token that does not match the key
The AWS Access Key Id you provided does not exist in our recordsAmazon S3's wording of the same: deleted key, or a temporary key without its session token
The security token included in the request is expiredTemporary credentials copied somewhere they cannot refresh
Token has expired and refresh failedThe SSO session ended: aws sso login
SignatureDoesNotMatchThe secret key does not belong to the key ID, or was altered on the way
RequestTimeTooSkewed, Signature expiredThe machine's clock is off
The config profile could not be found[profile name] in ~/.aws/config, but [name] in ~/.aws/credentials
Unable to locate credentialsNothing configured for the user or container the program runs as

Paste any of these into the decoder above to get every cause, in the order worth checking, with the command for each.

Frequently asked questions

Is it safe to paste an access key ID here?

Yes. The decoding runs in your browser: nothing you enter is uploaded, processed on a server or stored. The page only counts that the decoder was used and which error it recognized, never the text. An access key ID alone cannot sign requests, although it does reveal the account; never paste the secret access key anywhere.

What is the difference between AKIA and ASIA keys?

AKIA keys are long-term: they work until someone deactivates or deletes them. ASIA keys are temporary, issued by AWS STS for a role, an SSO sign-in or a session, and expire after minutes to hours. An ASIA key works only together with its secret key and session token.

Why does the decoder not show an account for my key?

The key is in the older format, which does not carry the account number, or the text is not a complete key ID. Run aws sts get-access-key-info to ask AWS. For IDs other than access keys - users, roles, policies - the decoder shows only the type.

How do I find which IAM user an access key belongs to?

In the key's own account, CloudTrail records every call made with it, including the user; or list the keys of a user with aws iam list-access-keys --user-name name. With the key's own credentials, aws sts get-caller-identity returns the user's ARN.

References

IAM identifiers: unique ID prefixes
AWS STS GetAccessKeyInfo
Configuration and credential file settings in the AWS CLI
Standardized credential providers in the AWS SDKs