Signup audit

How many of your users are burners?

Check the accounts you already have. Run one query in your own database, paste the one cell it returns, and see how many signups used throwaway email domains or the same Gmail inbox again.

No account and no install. Only email domains and a count for each leave your database (for example, gmail.com 812), never an address. Nothing is sent until you press the button in step 2.

1. Get your domain counts

Open your project's SQL editor.
Copy this query, paste it in and run it. It only reads auth.users.

Query for Supabase

-- signupbouncer audit: returns one cell with email domains and counts. No addresses.
with e as (
  select email, substring(email from '@([^@]*)$') as d
  from auth.users
  where email like '%@%'
),
u as (
  select case when d ~ '^[^[:space:]@",:;]+$' then lower(d) else '(invalid)' end as domain,
         lower(left(email, length(email) - length(d) - 1)) as local
  from e
),
d as (select domain, count(*) as n from u group by domain)
select 'sb1;' || (select count(*) from u)
  || ';' || (select count(*) - count(distinct replace(split_part(local, '+', 1), '.', ''))
             from u where domain in ('gmail.com', 'googlemail.com'))
  || ';' || (select count(*) from d)
  || ';' || coalesce((select string_agg(domain || ':' || n, ',' order by n desc, domain) from d), '')
  || ';end' as signupbouncer_audit;

Copy the single cell it returns and paste it below.

Paste the result here

The result looks cut off

With thousands of domains the cell can get very long, and an editor may cut it. This page warns you when that happens. This version lists only your 2,000 biggest domains. Accounts on the rest are counted but not checked.

Shorter query for Supabase

-- signupbouncer audit: returns one cell with email domains and counts. No addresses.
with e as (
  select email, substring(email from '@([^@]*)$') as d
  from auth.users
  where email like '%@%'
),
u as (
  select case when d ~ '^[^[:space:]@",:;]+$' then lower(d) else '(invalid)' end as domain,
         lower(left(email, length(email) - length(d) - 1)) as local
  from e
),
d as (select domain, count(*) as n from u group by domain
      order by n desc, domain limit 2000)
select 'sb1;' || (select count(*) from u)
  || ';' || (select count(*) - count(distinct replace(split_part(local, '+', 1), '.', ''))
             from u where domain in ('gmail.com', 'googlemail.com'))
  || ';' || (select count(*) from d)
  || ';' || coalesce((select string_agg(domain || ':' || n, ',' order by n desc, domain) from d), '')
  || ';end' as signupbouncer_audit;

On Lovable Cloud and can't open the SQL editor? Ask the Lovable chat to run the query and show the result. If that doesn't work, use the "Any list of emails" tab.

These read Better Auth's default user table. If your users live in another table, change the table name. The email column must be called email, or change that too.

Postgres

-- signupbouncer audit: returns one cell with email domains and counts. No addresses.
with e as (
  select email, substring(email from '@([^@]*)$') as d
  from "user"
  where email like '%@%'
),
u as (
  select case when d ~ '^[^[:space:]@",:;]+$' then lower(d) else '(invalid)' end as domain,
         lower(left(email, length(email) - length(d) - 1)) as local
  from e
),
d as (select domain, count(*) as n from u group by domain)
select 'sb1;' || (select count(*) from u)
  || ';' || (select count(*) - count(distinct replace(split_part(local, '+', 1), '.', ''))
             from u where domain in ('gmail.com', 'googlemail.com'))
  || ';' || (select count(*) from d)
  || ';' || coalesce((select string_agg(domain || ':' || n, ',' order by n desc, domain) from d), '')
  || ';end' as signupbouncer_audit;

MySQL

-- signupbouncer audit: returns one cell with email domains and counts. No addresses.
SET SESSION group_concat_max_len = 4194304;
WITH e AS (
  SELECT email, SUBSTRING_INDEX(email, '@', -1) AS d FROM `user` WHERE email LIKE '%@%'
), u AS (
  SELECT CASE WHEN d <> '' AND d NOT REGEXP '[[:space:]@",:;]' THEN LOWER(d) ELSE '(invalid)' END AS domain,
         LOWER(LEFT(email, CHAR_LENGTH(email) - CHAR_LENGTH(d) - 1)) AS local
  FROM e
)
SELECT CONCAT('sb1;', t.total, ';', t.repeats, ';', t.domains, ';', COALESCE(l.list, ''), ';end') AS signupbouncer_audit
FROM (
  SELECT COUNT(*) AS total,
    COUNT(CASE WHEN domain IN ('gmail.com', 'googlemail.com') THEN 1 END)
      - COUNT(DISTINCT CASE WHEN domain IN ('gmail.com', 'googlemail.com')
                            THEN REPLACE(SUBSTRING_INDEX(local, '+', 1), '.', '') END) AS repeats,
    COUNT(DISTINCT domain) AS domains
  FROM u
) t, (
  SELECT GROUP_CONCAT(CONCAT(domain, ':', n) ORDER BY n DESC, domain SEPARATOR ',') AS list
  FROM (SELECT domain, COUNT(*) AS n FROM u GROUP BY domain) d
) l;

Run the one for your database, copy the single cell it returns and paste it below.

Paste the result here

Paste one address per line, a CSV with a heading such as "email" on the address column, or a JSON export (one document, or one user per line as Auth0 writes it). For Firebase, run firebase auth:export users.json and paste the file. Text or CSV with a bracket or backslash anywhere, as in Ana <ana@example.com> or a note like "(admin)", is refused. Paste only the email column, or the JSON export. Auth0's CSV export is refused too. Use its JSON export, or a CSV of the email column alone.

Your browser picks out the addresses and counts the domains. The addresses stay on this page. Only the domain counts are sent. The query tabs send the same counts and are safer still, because there the addresses never leave your database at all.

Email addresses

2. Check what will be sent

This is everything that will be sent, one domain per line:

Nothing has been sent yet. The button sends only what is shown above.

3. Your result

Domain	Accounts	Finding	Why

What these accounts may have cost

Cost of one free account

"Up to", because not every one of these accounts used its whole free allowance, and some repeats may be real people who lost a password. The presets are examples. Your own number is better.

What this audit can't see

Only email domains. It can't see IP addresses, proxies, or bursts of signups from one network, and it can't tell a real person from a script on a normal Gmail address. Shadow mode on a free key checks all of that on new signups, without blocking anything.

Get a free key

Your app starts in shadow mode. New signups are checked and logged, and nothing is blocked until you switch it on. Setup is a URL and a secret pasted into Supabase's signup hook.

Need more than 1 app or IP checks? Paid plans start at $19 a month.

What we keep

No domain list. The domains live in memory while we check them, and we don't log them. For the mail-server check we ask a DNS resolver about domains we don't already know, and keep no copy of the answer.

For each audit we store the date, the rough size of your user base (1-19, 20-99, 100-999 or 1,000+), the share flagged as burners rounded to 1%, which tab you used, and an id that tells two audits from the same network apart on the same day.

That id is a keyed hash of your IP address. The key is random, one per day, and we delete it when the day ends at midnight UTC (if our server is down then, as soon as it is back). It is never in our backups. While the key exists, anyone holding it could check whether an id belongs to a given IP address, by hashing that address the same way. Once the key is deleted, the id can no longer be matched to an IP address.

If you are signed in, we check whether your account is one of our own test accounts, so our tests stay out of our launch numbers. The audit's row keeps only that yes or no, not your account. We also limit each network (an IPv4 /24 or IPv6 /64) to 5 audits and 200 checked domains a day. Larger automated checks use the API. Privacy.

If you ask us to email the report, we send it once to your verified login address. We keep no extra copy of your address for the audit. Our email provider, Postmark, keeps its own delivery record.