.env Toolkit

Q: Does anything from my .env file get uploaded or shared?

No. Parsing, comparison, and conversion all happen in your browser with plain JavaScript. Nothing is sent to a server, and values are never written into the page URL or stored in analytics.

Q: How are duplicate keys handled?

Duplicates are flagged so you can see them, and the first occurrence of each key is used for JSON/YAML/.properties conversion — this matches how most dotenv loaders behave (an earlier value is not silently overwritten by a later one).

Q: What does the environment comparison actually compare?

Only key names, never values. This lets you check for missing/extra configuration keys between two environments (e.g. staging vs. production) without ever exposing either environment's secrets.

Q: Are the secret warnings a security scan?

No — they're simple heuristics based on key names (e.g. containing SECRET or TOKEN) and value shape (e.g. AWS-key-like or PEM-like patterns). Treat them as a helpful nudge, not a guarantee of what is or isn't sensitive.

Paste a .env file below. Everything runs locally in your browser — parsed values are never sent anywhere, never written to the page URL, and never logged.

Input .env

Parsed entries (5)

1 value(s) look like they may hold secrets based on the key name or value shape (heuristic only, not a guarantee): API_KEY. Consider whether this file should ever be committed or shared.

2NODE_ENV=production

3PORT=3000

4DATABASE_URL=postgres://user:pass@localhost:5432/app

5API_KEY=sk_live_examplekeynotreal1234

6DEBUG=

{
  "NODE_ENV": "production",
  "PORT": "3000",
  "DATABASE_URL": "postgres://user:pass@localhost:5432/app",
  "API_KEY": "sk_live_examplekeynotreal1234",
  "DEBUG": ""
}

.env Toolkit

FAQ

Does anything from my .env file get uploaded or shared?

How are duplicate keys handled?

What does the environment comparison actually compare?

Are the secret warnings a security scan?