.env File Toolkit
Parse, validate, diff, convert, and sanitize .env files. Compare local vs production, export to Docker/K8s, generate .env.example. Runs entirely in your browser.
Syntax Rules
KEY=value-- basic assignmentKEY="value with spaces"-- quoted valuesKEY='literal $value'-- single-quoted (no expansion)# comment-- full-line commentKEY=value # inline-- inline comment (some parsers)EMPTY=-- empty value (valid but flagged)
Best Practices
- Use
UPPER_SNAKE_CASEfor key names - Quote values containing spaces,
#, or special chars - Never commit real
.envfiles to git - Keep a
.env.examplein your repo - Group related vars with comments
- Add
.envto.gitignore
Related Tools
Analyze HTTP headers for security issues, caching behavior, and CORS configuration with fix snippets.
Build and analyze Content-Security-Policy headers visually. Generate directives, detect security issues.
Calculate subnets, host ranges, and masks for IPv4 CIDR notation with visual binary breakdown.
From the makers of JSON Knife
Get the JSON & API Cheat Sheet
Formatting tricks, jq commands, and common patterns — one page, zero fluff.
.env File Validator, Diff Tool & Format Converter
.env files (dotenv files) are the standard way to manage environment-specific configuration in web applications, following the 12-Factor App methodology. They store key-value pairs like database URLs, API keys, feature flags, and service endpoints — keeping configuration separate from code and out of version control. Despite their ubiquity, there's no built-in tooling for validating, comparing, or converting them. This .env file validator and diff tool fills that gap: parse, validate, diff, and convert .env files entirely in your browser, with your secrets never leaving your machine.
Common .env mistakes that the validator catches: duplicate keys (the last value silently wins in most parsers, causing hard-to-diagnose bugs), values with unquoted spaces or special characters, missing equals signs, keys with leading/trailing whitespace, and values that look like they should be quoted but aren't. Paste your .env file and the validator highlights issues line-by-line with clear error messages before they cause production incidents.
Why validating your .env file matters: Environment variable bugs are notoriously hard to debug. A missing variable causes a runtime error that only appears in certain environments. A duplicate key silently overrides the first value. An unquoted value with spaces gets truncated at the first space. These bugs don't show up in tests if your test environment has correct defaults — they only appear in production. The validator surfaces these issues statically, before deployment.
The .env diff and compare tool solves the "works on my machine" problem. Paste your local .env and your staging or production .env side by side to see exactly which variables are missing from one environment, which have different values, and which match. This is invaluable when onboarding new developers (their .env is missing variables the app needs), debugging environment-specific bugs (different database URLs, different feature flags), or auditing configuration drift between environments.
Converting .env files to other formats is often necessary when deploying to different platforms. Docker Compose uses an environment: block or env_file reference. Kubernetes uses ConfigMaps for non-secret config and Secrets for sensitive values. CI/CD systems like GitHub Actions use repository secrets with a different syntax. This tool exports your .env to JSON, YAML, Docker Compose environment: blocks, and Kubernetes ConfigMap YAML — saving manual reformatting work.
Generating .env.example files: Every project should commit a .env.example file to version control — it shows new developers which variables are needed without exposing real values. The .env.example generator automatically detects common secret patterns (API keys, database connection strings, tokens, passwords) and replaces the actual values with descriptive placeholders like your_stripe_api_key_here or postgres://user:password@host/db, while preserving comments and structure. If your .env contains API tokens or CORS-related config, use the HTTP Header Analyzer to confirm those headers are being applied correctly by your server.
Tips
- Always quote values that contain spaces, equals signs, or special characters in .env files:
MY_VAR="value with spaces". - Use the validator to catch duplicate keys — the last value wins in most parsers, which can cause subtle bugs.
- The .env.example generator detects common secret patterns (API keys, database URLs, tokens) and replaces them with descriptive placeholders automatically.
- When converting to Kubernetes ConfigMap, remember that secrets should use K8s Secrets instead — ConfigMaps are not encrypted at rest.