Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

hashed_token

The base64 SHA-256 of the access token behind a GitHub audit log event, used to follow one credential across events without storing it.

hashed_token is an audit log field that holds the base64-encoded SHA-256 hash of the token used to authenticate an event: personal access tokens, OAuth tokens and GitHub App tokens, with SSH and deploy keys in preview. It sits next to programmatic_access_type and token_scopes.

To find a known token's events, compute echo -n TOKEN | openssl dgst -sha256 -binary | base64 and search hashed_token:"VALUE". UI and API searches exclude Git events, so export those separately. Grouping by this field separates a developer from someone replaying their stolen token. See leaked GitHub token.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.