Loading page
About this tool
Build a rotation calendar for API keys, tokens, passwords and certificates with owners, due dates and overdue flags — all in your browser.
The Secrets Rotation Schedule Planner builds a deadline-ordered rotation calendar for API keys, service tokens, database passwords, TLS certificates and signing keys from each secret's last-rotation date and interval. Recommended intervals follow published guidance — 90 days for cloud access keys under the CIS AWS Foundations Benchmark, a 200-day maximum lifetime for public TLS certificates issued from 15 March 2026 under CA/Browser Forum ballot SC-081, and NIST SP 800-57 cryptoperiods for keys. It is for platform, security and DevOps teams who track rotation in a spreadsheet today; everything runs in the browser and only secret names are entered, never values.
Open Secrets Rotation Schedule Planner on AltFTool — it loads instantly in your browser.
Set 'Plan as of date' and 'Flag as due soon within (days)', then name each entry — 'Payments API key' style names only, never the secret value.
Choose the Type, which carries a recommended interval such as 90 days for an API key or 200 days for a TLS certificate, add the Owner and Last rotated date, and press Add secret for the next one.
Read the Rotate by / Secret / Owner / Interval / Age / Status table sorted by soonest deadline, with Overdue and Due soon badges, then press Copy schedule.
Each secret type carries a recommended interval from CIS, CA/Browser Forum or NIST SP 800-57 that you can override per secret.
Every secret is classified against a configurable warning window, sorted by soonest deadline with owner attached.
You enter secret names and dates only — no secret values, and nothing leaves the browser.
Common published guidance is every 90 days or less: the CIS AWS Foundations Benchmark and AWS IAM best practices both use a 90-day maximum for access keys. Shorter is better for high-privilege keys, and immediate rotation is required whenever a key may have been exposed.
Public TLS certificates issued on or after 15 March 2026 have a maximum validity of 200 days under CA/Browser Forum ballot SC-081, dropping to 100 days in March 2027 and 47 days in March 2029. In practice teams automate renewal well before expiry — Let's Encrypt, for example, recommends renewing with a third of the lifetime remaining.
For human passwords, NIST SP 800-63B advises against forced periodic changes unless there is evidence of compromise. Machine credentials are different: database passwords, service-account tokens and API keys are shared, long-lived and often leaked in logs or config, so scheduled rotation (30-90 days is typical) plus event-driven rotation after any suspected exposure remains standard practice.
You should never enter secret values anywhere, including here — this planner only needs a name like 'Payments API key', its type, owner and last-rotation date. All computation happens locally in your browser; nothing is uploaded or stored on a server.