Home › Tools › Supabase Key Checker

Is my Supabase key exposed? Free checker

Paste your app’s URL. We scan the public HTML and JavaScript for Supabase, Stripe and AI keys, then tell you which are meant to be public and which are critical.

What this checker does, and what it never does

It loads your page once, follows at most 3 redirects, and reads up to 25 of the JavaScript files your site sends to every visitor (including code-split chunks one level deep). It looks for key patterns in that text, decodes legacy Supabase keys locally to read their role, and masks every key before showing it.

It never: contacts your Supabase project, uses a key it finds, queries your database or tests your RLS. RLS can only be checked with access to your project. That’s what the $49 Audit does.

Supabase keys explained in 30 seconds

Is it safe to have my Supabase key in my frontend code? Only the publishable key (sb_publishable_…) or the legacy anon key belongs in frontend code. It’s designed to be public, and Row Level Security decides what it can reach. A secret key (sb_secret_…) or legacy service_role key in your JavaScript is critical: it bypasses all RLS, giving anyone full access to your data. Rotate it immediately.

Found a secret key? What it means

Assume someone already has it. Supabase blocks secret keys sent from a browser, but that doesn’t make a leaked one harmless: it still works from any script or server. The order matters (remove the cause, then rotate), and we cover it step by step in what to do if you leaked your service_role key.

Why a “safe” key isn’t the whole story

A publishable or anon key is public by design. What protects your data is Row Level Security on every table. If a table has RLS off, or a policy that’s too open, anyone with your public key can read it. See how to tell if your app is leaking data and why RLS sometimes returns an empty array. We can’t see RLS from outside; the $49 Audit reviews it.

Supabase is retiring legacy keys (end of 2026)

Supabase is deprecating the anon and service_role keys by the end of 2026 in favour of publishable and secret keys. If the checker reports a legacy anon key, plan the switch. Separately, from October 30, 2026 new tables need explicit grants before your app can reach them: see the 5-minute checklist.

Other secrets we flag

• Stripe: live secret (sk_live_), live restricted (rk_live_) and organization (sk_org_) keys are critical; test secret keys (sk_test_, rk_test_) are a warning. Publishable keys (pk_) are meant for the browser, so we ignore them.
• AI providers: keys that look like OpenAI (sk-proj-) or Anthropic keys are critical. OpenAI doesn’t publish an exact key format, so we say “looks like”.
• Plus Stripe webhook secrets, AWS, GitHub, Slack and SendGrid keys, and private keys.

Key formats checked on October 19, 2026 against Supabase’s API keys guide and Stripe’s API keys docs.

Privacy

We fetch your page and its JavaScript files once, scan them in memory and throw them away. We don’t store your files or any key we find, and keys are masked before they leave our server. To stop abuse we count checks per hashed IP address and per checked domain in server memory for up to 24 hours; nothing about a check is written to disk or a database by us. If you ask for the email report, we store your email, the URL and the types of findings (never the keys themselves) to send it, plus one follow-up if you opt in. We never use a found key or access your database. Full details in our privacy policy.

FAQ