Is it safe to provide my anon key?

Yes, the anon key is a public key that is already available in your client-side code. We only use it to test table access and never store it.

Row Level Security (RLS) is Supabase's mechanism for controlling which rows a user can read and write. Without RLS, anyone with your anon key can read your entire database.

What if no tables are found?

That means you use custom table names that don't match the 35+ common names we test. This is actually good security practice (security through obscurity as a bonus).

Does it work with self-hosted Supabase?

Yes, as long as the project is accessible via HTTPS and has the PostgREST endpoint enabled.

Supabase RLS Checker

Check if your database is secured with Row Level Security

Data verified: August 2026

About RLS Checker

Supabase RLS Checker tests whether your database tables are protected against unauthenticated access. The tool attempts to read and write to common table names without authentication, exactly like an attacker would. Row Level Security (RLS) is the most important security mechanism in Supabase. Without RLS, anyone with your anon key can read and write all rows in your database. We never store your keys, everything runs directly from your browser against your own Supabase project.

How It Works

Connect — Provide your Supabase project URL and public anon key.
Scan Tables — We test 35+ common table names for unauthenticated read and write access.
Get Report — See which tables are exposed and get concrete remediation steps.

Frequently asked questions

Is it safe to provide my anon key?: Yes, the anon key is a public key that is already available in your client-side code. We only use it to test table access and never store it.
What is RLS?: Row Level Security (RLS) is Supabase's mechanism for controlling which rows a user can read and write. Without RLS, anyone with your anon key can read your entire database.
What if no tables are found?: That means you use custom table names that don't match the 35+ common names we test. This is actually good security practice (security through obscurity as a bonus).
Does it work with self-hosted Supabase?: Yes, as long as the project is accessible via HTTPS and has the PostgREST endpoint enabled.

Try RLS Checker free