Environment Validator
Validate .env file for correct format, duplicates, and sensitive patterns.
Contenuto file .env
Come utilizzare ENV Validator
Attach the file content from .env
Attach the text of your .env file to the editor, or click "Load example" to see the tool in action with typical errors and warnings.
Start validation
Click on "Validate": the check is performed entirely in the browser, line by line, without sending content to any server.
Review errors, warnings, and sensitive keys
Each line is colored based on severity (error, warning, info) and the specific message is shown: invalid format, duplicate key, empty value, unquoted spaces or a key that seems to contain sensitive data.
Download or copy the clean version
Use the button to mask sensitive values in preview, then copy or download the verified .env file to use it in your project.
Suggerimenti
- Always mask sensitive values before sharing the screen or taking a screenshot of the validation result.
- Use "Load Example" to quickly understand the types of errors reported, then paste your real file for a full check before committing.
- If the validator flags sensitive keys, immediately check that your .env file is present in your .gitignore to avoid exposing credentials in the repository.
- A secret that has already reached git must be considered compromised: removing it from the file is not enough, it has to be revoked and regenerated.
Domande frequenti
What errors and warnings does the ENV Validator detect?
Detect invalid blocking errors such as missing equals sign ("="), characters not allowed in keys, and duplicate keys; warn on empty values or values with unquoted spaces; and provide info for keys that seem to contain sensitive data (API key, secret, password, token).
How are sensitive keys recognized?
The tool applies common textual patterns to the key name, such as API_KEY, SECRET, PASSWORD, TOKEN, PRIVATE_KEY or CLIENT_SECRET. If a key matches these patterns, an informative warning is shown to remind you not to commit the .env file to Git.
Is my .env file content sent to a server?
No, validation occurs entirely in the browser with pure TypeScript code: no line from your file, including sensitive keys, ever leaves your device or is saved anywhere.
Why is a duplicate key considered an error?
In .env files, if a key appears more than once, most parsers (dotenv and similar) keep only the last occurrence overwriting silently the previous ones. This can cause hard-to-find bugs, so the tool always flags it as an error to correct.
Why are values with spaces quoted?
Many .env parsers interpret space as the end of a value if not enclosed in quotes, cutting off the actual value. Enclosing the value in single or double quotes (e.g. KEY="value with spaces") ensures it is read correctly as a whole.
Which plaintext secrets does the in-depth analysis recognize?
Values in the format of AWS access key ids, GitHub and Slack tokens, Stripe keys, Google API keys, JSON Web Tokens, keys with the sk- prefix, private key blocks and URLs with an embedded username and password; also credential-like names (SECRET, TOKEN, PASSWORD...) with a value that does not look like a placeholder. It is a format-based check, not a guarantee: a secret in a different format is not recognized.
How do different parsers handle interpolation?
It depends on the parser. Docker Compose and dotenv-expand expand references (the braces form and the $VAR form) outside single quotes; other parsers keep them as text. The tool reports every reference, those to variables defined further down and those to variables missing from the file, so you know where the result depends on the parser.