Free tool
Is this key safe to expose?
Paste the first few characters of an API key. We'll tell you whether it's public by design or a secret you need to rotate, and what to do next.
100% in your browser. What you type is never sent anywhere: no network request, no form, nothing stored. Even so, paste only the prefix (for example sk_live_), never a whole secret.
Checked in your browser as you type. Nothing is sent anywhere. The prefix is enough for almost every key.
Public by design vs secret
| Public by design (fine in your frontend) | Secret (server only; rotate if exposed) |
|---|---|
Supabase sb_publishable_… or the legacy anon JWT | Supabase sb_secret_… or the legacy service_role JWT |
Firebase web config apiKey (AIza…) | A Gemini or other paid Google API key (also AIza…) |
Stripe pk_live_… / pk_test_… | Stripe sk_live_…, rk_live_…, whsec_… |
| Analytics site IDs | OpenAI sk-…, Anthropic sk-ant-…, AWS AKIA…, GitHub ghp_…, Resend re_… |
A public key is only safe if what it can reach is locked down: Row Level Security for Supabase, Security Rules for Firebase. A secret key in your frontend is a leak whatever else you've done, so the first step is always to rotate it.
FAQ
Is anything I paste sent to SealMyApp?
No. The check runs in your browser as you type, with no network request, no form submission and nothing saved. You can disconnect from the internet after the page loads and it still works.
Why paste only the prefix?
The prefix is what identifies the kind of key, and you should never paste a whole secret into a website you don't control. The one exception is a legacy Supabase key starting eyJ: the role that decides anon or service_role is inside the token, so paste the whole thing if you want this page to decode it locally.
My Supabase anon key is visible in my app. Is that a leak?
No. The anon and publishable keys are designed to be public; Row Level Security is what protects your data. See is my Supabase anon key safe to expose?
I found a secret key in my frontend. What first?
Rotate it before anything else. Removing it from your code doesn't help, because every visitor has already downloaded it. Then move the call to server code. Our guide to finding leaked keys in your bundle walks through it.
Sealed — a short weekly security note for vibe coders
One common security mistake in AI-built apps, how to fix it in your builder, and one useful tool. No spam; unsubscribe any time.