Check a .env file without uploading your secrets
A .env file is a list of secrets and almost nothing else. You can check it for duplicate keys, mask the values while you read it, and produce a .env.example, without the credentials leaving your machine.
At a glance
- Tool
- /tools/env-editor
- Detects
- Duplicate keys
- Display
- Masks secret values while you read the file
- Generates
- A .env.example carrying the keys and none of the values
- What the file holds
- Database URLs, API keys, tokens and signing secrets
- If it is ever uploaded
- Rotate every value in it
In detail
Every other file in this cluster mixes harmless content with sensitive content. A .env is one hundred percent credentials by design, and a single connection string in one carries a username, a password, a host and a database name together on one line. Pasting that into a hosted validator is a credential disclosure, and the honest response afterwards is to rotate everything in the file, which means hours of work and a change to production, at a moment you did not choose.
Duplicate keys are the reason people reach for a validator in the first place. The same key set twice is a real bug, because which value wins depends on the loader, and the usual cause is a merge that nobody read carefully. Finding it requires the file to be read, which is precisely the operation that ought to happen on your own machine.
Masking helps with the other half of the problem, which is that a .env is usually opened while someone is watching. A masked view survives a screen share, a screenshot in a ticket and a colleague walking past. It changes what is displayed rather than what is stored, so the file on disk is untouched and a recording of an unmasked view is the same disclosure it always was.
Generating a .env.example is the useful output: the shape of the configuration, committable, with no values. Read it before committing, because key names can themselves name internal services and third party providers. Do all of this with the network disconnected once, and you will know what the tool is and is not doing.
Examples
Masked view DATABASE_URL=postgres://app:********@db.internal:5432/app
STRIPE_SECRET_KEY=sk_live_****************
JWT_SIGNING_SECRET=********************
Generated .env.example DATABASE_URL=
STRIPE_SECRET_KEY=
JWT_SIGNING_SECRET=The key names alone can reveal which providers you use. Check the example file before committing it.
Things that catch people out
- A .env that has been in a chat, a ticket or a hosted tool is a .env that needs rotating. There is no way to un-share a credential.
- Masking hides values on screen only. The file is unchanged, and so is anyone's screen recording of it unmasked.
- Check the generated .env.example before committing. Key names can name internal services and third parties.
Try it: Hash Generator
The file hasher is on every page here because it takes any file at all and proves the point: disconnect from the network, drop a file in, and it still returns a checksum you can compare against a published one.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Working without uploading
All working without uploading →Decode a JWT without sending it to a website
Read and verify a token in your browser. A JWT is a live credential: pasting one into a hosted decoder hands over a working session.
Convert YAML to JSON without uploading the file
Convert YAML and JSON both ways in your browser. Infrastructure YAML is configuration, and configuration is where credentials sit.
Encrypt text in your browser without uploading it
AES encryption that runs locally, so the plaintext and the passphrase both stay put. What that protects, and what it cannot protect.
Base64 encode a file without uploading it
Encode files or text in your browser, with a URL-safe variant and line wrapping. Base64 is a transport encoding, never encryption.
Generate a password without a server seeing it
Create passwords in your browser. A password produced by a remote service is a password that existed on somebody else's machine first.
Generate a QR code without uploading what it encodes
Make a QR code in your browser. The payload never leaves, and the result points where you said rather than through somebody else.
Tools for this
- .env Editor & Validator Edit and validate .env files online - detect duplicates, mask secrets, generate .env.example
- Password Generator Strong password generator online - generate secure random passwords that never leave your browser
- AES Encryption Tool Free online AES encryption tool - encrypt and decrypt text using AES-256 encryption