free, runs only in your browser
Is this key safe in my website?
Paste a Supabase, Stripe, OpenAI or other API key and see what it is and whether it may be public. Nothing is sent anywhere: the check runs on this page.
Not sent, not stored, not logged.
The answer shows up here as you paste.
Supabase keys at a glance
| Key | Looks like | In your website? | What protects you |
|---|---|---|---|
| Publishable | sb_publishable_… | Yes | Row level security policies |
| Anon (legacy) | eyJ… with role "anon" | Yes | Row level security policies |
| Secret | sb_secret_… | Never | Nothing: it skips RLS |
| Service role (legacy) | eyJ… with role "service_role" | Never | Nothing: it skips RLS |
Questions
- What is the difference between the Supabase anon, publishable and service role keys?
- The anon key (a JWT starting with eyJ) and the newer publishable key (sb_publishable_) are public keys for your website: row level security decides what they can do. The service role key (a JWT with role service_role) and the newer secret key (sb_secret_) skip row level security and must only be used on a server.
- Is the Supabase publishable key safe to expose?
- Yes. It replaces the anon key in newer projects and is designed to be in your website. It is only as safe as your row level security policies: without them, anyone with the key can read and change your tables.
- Where do I find my Supabase keys?
- In the Supabase dashboard under Project Settings, API Keys. Publishable and anon keys are listed as public; secret and service role keys are hidden until you reveal them.
- I put the service role key in my website. What now?
- Treat it as leaked. Create a new secret key (or roll the JWT secret for legacy keys), switch your Edge Functions and server to it, deploy, and then disable the old one. Check the API logs for requests you did not make.
- Does this tool send my key anywhere?
- No. It runs entirely in your browser: the key is read on this page and never sent to Redproof or anyone else. You can turn off your internet connection and it still works.