Environment variables

Any variable in .env.local is available in the browser through process.env.

communityWidely shared Next.js Q&A answersconfidence 25%current as of Jan 2023

A common belief is that every entry in .env or .env.local can be read from the browser through process.env. Only names prefixed with NEXT_PUBLIC_ reach the client. Relying on this belief either leaks a value you meant to keep server side or reads undefined on the client. The prefix rule is what decides exposure.

Related claims

is contradicted by

Only environment variables prefixed with NEXT_PUBLIC_ are exposed to the browser. Others stay server only.

One says only NEXT_PUBLIC_ variables reach the browser while the other says any .env variable does. The prefix rule is what Next.js enforces so the official claim holds.