Loading page
About this tool
Build a rotation calendar for API keys, tokens, passwords and certificates with owners, due dates and overdue flags — all in your browser.
This planner builds a deadline-ordered rotation calendar for API keys, service tokens, database passwords, TLS certificates and signing keys from each secret's last-rotation date and interval. Recommended intervals follow published guidance — 90 days for cloud access keys under the CIS AWS Foundations Benchmark, a 200-day maximum lifetime for public TLS certificates issued from 15 March 2026 under CA/Browser Forum ballot SC-081, and NIST SP 800-57 cryptoperiods for keys. It is for platform, security and DevOps teams who track rotation in a spreadsheet today; everything runs in the browser and only secret names are entered, never values.
Open Secrets Rotation Schedule Planner on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Each secret type carries a recommended interval from CIS, CA/Browser Forum or NIST SP 800-57 that you can override per secret.
Every secret is classified against a configurable warning window, sorted by soonest deadline with owner attached.
You enter secret names and dates only — no secret values, and nothing leaves the browser.
Common published guidance is every 90 days or less: the CIS AWS Foundations Benchmark and AWS IAM best practices both use a 90-day maximum for access keys. Shorter is better for high-privilege keys, and immediate rotation is required whenever a key may have been exposed.
Public TLS certificates issued on or after 15 March 2026 have a maximum validity of 200 days under CA/Browser Forum ballot SC-081, dropping to 100 days in March 2027 and 47 days in March 2029. In practice teams automate renewal well before expiry — Let's Encrypt, for example, recommends renewing with a third of the lifetime remaining.
For human passwords, NIST SP 800-63B advises against forced periodic changes unless there is evidence of compromise. Machine credentials are different: database passwords, service-account tokens and API keys are shared, long-lived and often leaked in logs or config, so scheduled rotation (30-90 days is typical) plus event-driven rotation after any suspected exposure remains standard practice.
You should never enter secret values anywhere, including here — this planner only needs a name like 'Payments API key', its type, owner and last-rotation date. All computation happens locally in your browser; nothing is uploaded or stored on a server.