Which environment variables end up in my public JavaScript?
One prefix decides whether a value stays on your server or gets written into the file every visitor downloads. Nothing warns you when you get it wrong. Paste your variable names — not the values — and see which is which.
Names only — you can paste a whole .env and everything after each = is thrown away before it is read. This runs entirely in your browser and nothing is sent anywhere.
Seven frameworks, seven prefixes
Each means the same thing to its own framework: put this value in the browser bundle. Anything without one stays server-side.
- NEXT_PUBLIC_
- Next.js
- VITE_
- Vite
- REACT_APP_
- Create React App
- PUBLIC_
- Astro, SvelteKit
- NUXT_PUBLIC_
- Nuxt
- EXPO_PUBLIC_
- Expo
- GATSBY_
- Gatsby
Prefixes, rebuilds and rotation
Got a specific key to check? See whether it is safe to expose. Or scan your published site for what actually shipped.
Why does the prefix matter?
Frontend frameworks will not put a value into the browser unless you ask them to, and the prefix is how you ask. NEXT_PUBLIC_, VITE_, REACT_APP_, PUBLIC_, EXPO_PUBLIC_, NUXT_PUBLIC_ and GATSBY_ each mean the same thing to their own framework: inline this into the bundle. Without one, the value stays on the server.
The value is in my hosting dashboard, not my code. Is it still exposed?
Yes, if it has a public prefix. The value is read at build time and written into the JavaScript your visitors download. Where you typed it makes no difference to where it ends up.
I removed the prefix but the old value is still in the bundle.
Environment variables are baked in when the app is built, so the change does not take effect until you rebuild. Re-publishing without a fresh build keeps serving the old bundle, with the old value inside it.
Do I need to rotate a key that was exposed and then removed?
Yes. Removing it from a future build does not un-publish the builds that already shipped, and anyone who downloaded one still has the value. Rotation is the only thing that makes the old value useless.
Does this see the values of my variables?
No. It reads only the text before each equals sign and discards the rest before anything looks at it. There is also no server behind this page, so there is nowhere for a value to be sent even if it were read.