Environment File Validator
Paste .env file content to detect duplicate keys, invalid variable names, malformed lines, and missing values, then generate a sanitized .env.example with secrets masked. Nothing is stored or transmitted.
Free to use · Runs in your browser · No account required
Processed locally in your browser
Nothing you enter here is uploaded, transmitted to a server, or stored by this tool. Never paste real production secrets — process a copy with placeholder values if you're unsure.
Runs entirely in your browser — nothing is sent to a server
Never paste real production secrets here — use a copy with placeholder values if you're unsure.
Paste .env content above
Load the example to see duplicate keys, invalid names, and missing values flagged.
How to use this tool
- 1Paste your .env content, or load the example to see the kinds of issues this tool catches.
- 2Review line-by-line errors (invalid names, malformed lines) and warnings (duplicates, missing values, stray whitespace).
- 3Optionally reveal masked values to sanity-check which variables were detected — raw values are never shown.
- 4Copy the generated .env.example, which keeps every variable name but replaces values with a placeholder.
What this validator checks
.env files follow a simple but easy-to-get-wrong convention: one KEY=value pair per line, an optional export prefix, # comments, and quoting for values with special characters. This tool checks variable-name syntax (letters, digits, underscores, not starting with a digit), flags duplicate keys (the last definition usually wins silently), catches lines with no =, and warns about unquoted leading/trailing whitespace that most loaders keep literally.
The generated .env.example is the safe artifact meant for version control — it preserves every variable name so teammates know what to configure, but never guesses or reconstructs a real secret value.
Frequently asked questions
Is my .env content uploaded anywhere?
No. Parsing, validation, and sanitization all run in your browser's JavaScript engine. Nothing is transmitted, logged, or persisted to storage.
How does the sanitized .env.example handle secret values?
It keeps every variable name but replaces its value with a placeholder such as `changeme`. It never tries to guess or reconstruct the real secret.
What counts as a duplicate key?
Two or more non-comment lines defining the same variable name, ignoring surrounding whitespace. The last definition normally wins at runtime, which this tool flags as a likely mistake.
Related writing
Planned — not yet published
- PlannedThe .env.example convention: keeping secrets out of git without guesswork— Team workflow for onboarding without leaking real values.
- PlannedLoading environment variables safely in Node.js and Next.js— dotenv, NEXT_PUBLIC_ prefixes, and build-time vs runtime env.
- PlannedCommon .env mistakes that break deploys silently— Trailing whitespace, missing quotes, and duplicate keys.
Related tools
- Database
PostgreSQL Connection URL Builder
Assemble a correctly encoded PostgreSQL or Prisma connection string.
- API development
CORS Configuration Generator
Generate framework-specific CORS configuration from your allowed origins and methods.
- Data formatting
JSON Formatter & Validator
Format, minify, and validate JSON with clear syntax-error locations.