env.dev

.env Validator

Check literal .env syntax, compare .env.example keys, and generate a values-free example. Review naming advice and secret patterns locally.

Last updated:

Client-side only — your data never leaves the browser

Literal syntax: optional export, spaces around assignments, CRLF and quoted multiline values are supported. Backslashes and dollar signs stay literal; quotes cannot be escaped. Unquoted # starts a comment. Empty values and lowercase names are valid. Reference checks are advisory; loaders differ.

Input

Results

Paste or drop a .env file to validate

How to Use .env Validator

  1. 1Paste the contents of your .env file into the input area, or drag and drop the file.
  2. 2Optionally paste .env.example to compare missing and extra keys; review syntax separately from advisory checks.
  3. 3Fix syntax errors before generating a keys-only example. The generated example omits all values and comments.
  4. 4Rotate any secret flagged as leaked — the detector matches live AWS, GitHub, Stripe, Slack, Google, and npm tokens.
  5. 5Adjust naming conventions — the validator flags keys that do not follow UPPER_SNAKE_CASE.

Frequently Asked Questions

Does my .env file leave the browser?

No. Parsing, validation, and secret-leak scanning all happen entirely client-side. The validator is bundled with the page and runs in your browser — your file is never sent to any server.

Which secret types does the leak detector catch?

High-confidence patterns only: AWS access key IDs (AKIA…/ASIA… etc.), GitHub PATs (ghp_, github_pat_, gho_, ghs_, ghu_), Stripe live keys (sk_live_, rk_live_), Slack tokens (xoxb-/xoxp-/xoxa-…) and incoming webhook URLs, Google API keys (AIza…), npm tokens (npm_…), and PEM private key headers. Stripe test keys (sk_test_) and placeholders are intentionally not flagged.

Will it flag a secret I just rotated?

Yes — the detector matches the pattern, not the validity. After rotation, replace the old value with a placeholder (or remove the line) so the validator stops reporting it. Treating any pattern hit as a "rotate now" signal is safer than trusting the detector to know which keys are still active.

Which variables does it know about?

It cross-references your file against the env.dev environment-variable reference — AWS, Azure, Google Cloud, Docker, Node.js, databases, CI/CD, and general OS variables.

What does "required for production" mean?

Required keys depend on your application. Supply .env.example to check missing keys; the validator does not treat every variable in the reference as required. Empty values and lowercase names are valid syntax.

Related Tools

.env Builder

Generate .env templates for Node.js, Docker, and AWS. Review defaults and loader instructions, then copy or download.

.env Converter

Paste a .env file, get the equivalent for Docker Compose, Kubernetes ConfigMap, Vercel CLI, AWS Parameter Store, GitHub Actions, or shell exports. Client-side.