Firebase Security Rules Generator
Fast, accurate, and free online Firebase Security Rules Generator tool that runs directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
Rate this tool:
Related tools
Other tools you may find usefulFirebase Security Rule Generator - Firestore and Storage Rules
Firebase Security Rule Generatorcreates security rule templates for Firebase Firestore and Storage - tailored to common access patterns: authorized users only, owner access, role-based rules (RBAC), and more.
What are Firebase security rules?
Firebase Security Rules are a declarative language that defines who can read or write data to Firestore, Realtime Database, and Storage under what conditions. The rules are server-side - the client cannot bypass them, even by modifying JavaScript code. They are a key security element of any Firebase application.
The default Firebase configuration after creating a project allows reading and writing to anyone (public) or blocks everyone - neither option is good for production. Always define granular rules before implementation.
Basic Firestore Rule Patterns
Authenticated Only: allow read, write: if request.auth != null;- only logged in users.Owner only: allow read, write: if request.auth.uid == resource.data.userId;- Document creator only.Public read, authenticated write: allow read: if true; allow write: if request.auth != null;- Perfect for blogs.RBAC - role-based access: checking the user's role in a separate document /users/{uid}.Data validation: request.resource.data.title is string- type checking before writing.
Firebase Storage Rules
Storage rules are similar to Firestore, but operate on file paths. Typical patterns: allowing only logged-in users to upload photos, limiting the file size (request.resource.size < 5 * 1024 * 1024for max 5MB), limiting the file type (request.resource.contentType.matches('image/.*')), accessing only your own files (userId == request.auth.uid).
Testing and Debugging Rules
Firebase Emulator Suite allows you to test rules locally without touching production:firebase emulators:start. Firebase Console includes Rules Playground - you can simulate requests and see if they are accepted or rejected. Always test rules before deploying to production - an error could block access to data or open a security hole.
Frequently asked questions
How to allow only its owner to read a document?
In Firestore:match /users/{userId} { allow read, write: if request.auth.uid == userId; }. For nested collections:match /posts/{postId} { allow read, write: if request.auth.uid == resource.data.authorId; }. We assume that each post document has its authorId field set to the creator's UID.
How to implement roles (admin, user) in Firebase Security Rules?
Store roles in the /users/{uid} collection:{roles: "admin"}. In the rules:function isAdmin() { return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "admin"; }. Then:allow write: if isAdmin();. Remember: the get() function has a read cost - avoid calls to hot paths.
How to validate data before saving in Firestore?
Userequest.resource.datato validate new data:allow write: if request.resource.data.title is string && request.resource.data.title.size() <= 100 && request.resource.data.createdAt == request.time;. This ensures that the client cannot write invalid data, even with direct access to the SDK.
Do Firebase Security Rules replace server-side validation?
No - Firebase Security Rules are a supplement to, not a replacement for, server-side validation. Rules protect against unauthorized access directly to Firestore. But for complex business operations (transactions, multi-document operations, external integrations), use Firebase Cloud Functions with its own validation logic.
What is request.auth.token and how to use it in rules?
request.auth.token contains the JWT decoded Firebase Authentication token - contains standard claims (uid, email, email_verified) and custom claims set by the Firebase Admin SDK. Example:allow write: if request.auth.token.admin == true;. You set custom claims via Admin SDK:admin.auth().setCustomUserClaims(uid, {admin: true}).