Next.js Env Leak Checker
The rule nobody reads until it burns them: everything prefixed NEXT_PUBLIC_ is compiled into your public JavaScript bundle. Paste your .env and catch the leaks before your users do.
Everything runs in your browser — this page makes zero network requests with your input. Still cautious? Replace values with placeholders: the checks that matter read the key names and token structure, not your actual secrets.
What gets checked
NEXT_PUBLIC_ secret exposure
any secret-looking name carrying the prefix is inlined into the public JS bundle at build time
Supabase service_role in the client
JWT payloads are decoded locally — a service_role token behind NEXT_PUBLIC_ means every RLS policy is bypassable
anon key missing its prefix
the #1 cause of "supabaseKey is required" — the anon key is designed to be public and needs NEXT_PUBLIC_
.env syntax pitfalls
export prefixes, unquoted spaces, invalid lines that Next.js silently skips
Duplicates and localhost-in-prod
last definition wins; URL variables pointing at your laptop
Env vars fine, but the build still fails?
Paste the failing output into the Build Error Decoder, or read the full env-variables deep-dive — build-time inlining, per-environment scoping, and the redeploy trap.
Read the env variables deep-dive