We use cookies to understand how the site is used and to display ads. Analytics and advertising only run after you accept. You can change your choice anytime via the footer link or your browser settings. Privacy policy

Skip to content
>_devvkit

.env File Validator

Lint .env files: syntax, duplicates, secrets, and clean exports.

7 variables4 errors0 warnings2 potential secrets
ERROR · Duplicate keyline 3

API_URL already defined on line 2 — later definitions silently override earlier ones.

ERROR · Possible secretline 4

DB_PASSWORD looks like a credential. Commit it to the repo only via a .env.example placeholder.

ERROR · Invalid lineline 6

"unquoted value with spaces" is not KEY=VALUE. Keys must start with a letter or underscore.

ERROR · Possible secretline 8

AWS_SECRET_ACCESS_KEY looks like a credential. Commit it to the repo only via a .env.example placeholder.

INFO · Missing final newlineline 8

The file does not end with a newline.

Cleaned export

Checks syntax (KEY=VALUE, quotes, inline comments), duplicate keys, and common secret patterns (AWS keys, GitHub tokens, OpenAI keys, PEM blocks, and *PASSWORD/*SECRET/*TOKEN key names). Secret detection is heuristic — verify before acting. All analysis runs locally.

//Share this tool
//Related tools
JSON Formatter
Format, validate, minify, and prettify JSON data instantly.
JWT Decoder
Decode and inspect JWT tokens: header, payload, signature, expiration.
Base64 Encoder/Decoder
Encode text or files to Base64 and decode back. UTF-8 safe.
Regex Tester
Test regular expressions in real-time with match highlighting and groups.

Lint .env files for syntax errors, duplicate keys, unquoted values, and accidental secrets. Export a cleaned .env with duplicates resolved and sensitive values filtered out.

[x]Features
  • -KEY=VALUE syntax checks with line numbers
  • -Duplicate key detection
  • -Quote and inline-comment warnings
  • -Heuristic secret detection (AWS keys, tokens, PEM blocks)
  • -Cleaned export for .env.example
  • -Runs entirely locally
>Use Cases
  • >Auditing env files before committing to a repo
  • >Generating a safe .env.example from a real .env
  • >Catching duplicate keys that silently override
  • >Teaching dotenv quoting rules

Frequently Asked Questions

>Are my secrets safe??
Yes. All analysis is local — nothing is uploaded. Secret detection runs on patterns in your own browser.
>What counts as a secret pattern??
Key names containing PASSWORD, SECRET, TOKEN, KEY or similar, plus known formats like AWS access keys, GitHub tokens, and OpenAI keys. It is heuristic — always verify before acting.
>What does the clean export do??
It strips duplicate keys (first wins), re-quotes values that need quotes, and optionally removes detected secrets — handy for generating a .env.example.