Skip to content
ENExplore Calculators

Secrets Rotation Calculator

Work out rotation window risk as exposure days over rotation period, plus manual rotation effort, storage cost and a recommended period.

About Secrets Rotation Calculator

Rotation caps the damage window at the rotation period, and detection caps it at the detection time, so the real exposure is whichever is shorter. The ratio between them tells you which control is doing the work: below 1 you find leaks before rotation would have helped, at or above 1 you are relying entirely on the calendar. A ninety-day rotation period sounds diligent until you notice that credentials leak to public repositories in minutes and are used within hours — the period only bounds the tail, and the recommended figure here is half the detection window so a leaked secret expires before it is worth selling.

Formulas

Secrets Rotation

Rotation window risk ratio = days a leaked secret goes undetected ÷ rotation period. A ratio of 1 or more means rotation, not detection, is what ends the exposure.

exposureDays
Mean time to detect that a secret has leaked
rotationPeriodDays
Days between scheduled rotations
riskRatio
Exposure days ÷ rotation period

Risk scoring

Risk score = 30 × min(2, ratio) + 0.3 × (100 − automatic rotation coverage) + min(40, 0.5 × effective window days), where the effective window is min(exposure days, rotation period).

effectiveWindowDays
The shorter of detection time and rotation period — how long a leaked secret actually works
coveragePts
Penalty for secrets still rotated by hand

Worked example

With the default values below, Secrets Rotation Calculator returns Rotation Risk Score of 36.4. Change any input above and every figure here is recalculated in your browser.

Inputs used

Secrets under managementaccepts 1–1,000,000 secrets
420 secrets
Rotation periodaccepts 1–3,650 days
90 days
Days a leaked secret goes undetectedaccepts 0–3,650 days
30 days
Secrets on automatic rotationaccepts 0–100 %
62 %
Engineer time per manual rotationaccepts 0–2,000 minutes
25 minutes
Engineer hourly costaccepts 0–1,000 USD/hour
85 USD/hour
Secret storage priceaccepts 0–50 USD/secret/month
0.4 USD/secret/month
Failed rotations per yearaccepts 0–200,000 failures
18 failures

Results

Rotation Risk Score
36.4 / 100
Rotation Window Risk Ratio
0.333 ×
Risk Level
Low
Rotations per Year
1,703 rotations
Manual Rotation Effort
269.7 hours/year
Annual Manual Rotation Cost
$22,924
Monthly Secret Storage Cost
$168.00
Recommended Rotation Period
15 days
Verdict
Automate the remaining secrets — manual rotation is the reason periods get stretched

Step by step

  1. 1Values used
  2. 2Secrets Rotation
  3. 3Risk scoring
  4. 4Rotation Risk Score= 36.4 / 100
  5. 5Rotation Window Risk Ratio= 0.333 ×
  6. 6Risk Level= Low
  7. 7Rotations per Year= 1,703 rotations
  8. 8Manual Rotation Effort= 269.7 hours/year
  9. 9Annual Manual Rotation Cost= 22,924

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation or tax into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Secrets Rotation calculated?

Rotation window risk ratio = days a leaked secret goes undetected ÷ rotation period. A ratio of 1 or more means rotation, not detection, is what ends the exposure. Rotation caps the damage window at the rotation period, and detection caps it at the detection time, so the real exposure is whichever is shorter. The ratio between them tells you which control is doing the work: below 1 you find leaks before rotation would have helped, at or above 1 you are relying entirely on the calendar.

Why does Secrets Rotation matter?

A ninety-day rotation period sounds diligent until you notice that credentials leak to public repositories in minutes and are used within hours — the period only bounds the tail, and the recommended figure here is half the detection window so a leaked secret expires before it is worth selling.

What values do I need to enter?

This calculator takes 8 inputs: Secrets under management, Rotation period, Days a leaked secret goes undetected, Secrets on automatic rotation, Engineer time per manual rotation, Engineer hourly cost, Secret storage price, Failed rotations per year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is more frequent rotation always better?

No — it trades one risk for another. Every rotation is a chance of an outage, and a team that gets paged by rotation failures will quietly widen the period or disable it. Fix the failure rate first, automate second, then shorten. A reliable 30-day rotation beats an aspirational 7-day one that is switched off.

Should short-lived credentials replace rotation entirely?

Where you can, yes. An IAM role with 15-minute credentials or an OIDC-federated workload token has no rotation problem because there is nothing long-lived to rotate. Reserve stored secrets for the cases that genuinely cannot federate, such as third-party API keys and legacy database users.

Related Calculators

Secrets Rotation Calculator – Calculate Rotation Risk Score