Secret Lifetime Calculator

v1.0.0

TTL planner for tokens / secrets — entropy, blast radius, rotation cost trade-offs.

Token / Secret type

Data sensitivity

Result

Secret Lifetime Recommendation

Type:        API-key
Sensitivity: medium

Recommended TTL: 90 days

All sensitivity levels for API-key:
  low       1 year
  medium    90 days
  high      30 days
  critical  7 days

OWASP references:
  ASVS 2.8: Session tokens should expire after inactivity and at absolute max TTL
  ASVS 3.2: Use short-lived tokens + refresh where possible
  Store in Vault or AWS Secrets Manager for automated rotation