.env File Validator

.env files store environment variables — configuration values and secrets (API keys, database URLs, passwords) that your application reads at runtime. They should never be committed to version control. Validation catches common problems before they cause runtime failures: malformed syntax, duplicate keys that silently override each other, missing required variables, or accidentally hardcoded secrets.

This tool flags values that match patterns commonly used for secrets: long random strings (>20 chars with mixed case and numbers), values starting with common key prefixes (sk-, pk-, AKIA, ghp_, xoxb-), base64-looking strings, and values containing words like 'password', 'secret', 'token', 'key'. These warnings don't mean your value is definitely a secret — they're prompts to double-check before committing.

.env files follow a simple KEY=value format. Rules: one variable per line, no spaces around the = sign, values with spaces or special characters should be quoted (KEY="value with spaces"), lines starting with # are comments. Empty lines are ignored. Keys should be uppercase with underscores. Values can be unquoted (KEY=simple), single-quoted (KEY='value'), or double-quoted (KEY="value").

The behavior depends on the library loading your .env file. Most (dotenv for Node.js, python-dotenv) use the first occurrence and silently ignore duplicates. Some use the last. This inconsistency is a common source of bugs — you change a variable and can't figure out why the old value keeps appearing. This tool detects duplicates and flags all occurrences so you can clean them up.

Never commit your actual .env file containing secrets to version control. Instead, commit a .env.example file with all the expected keys but empty or placeholder values (e.g. DATABASE_URL=), so other developers know what variables are needed. Add .env to your .gitignore. For team deployments, use a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler) or your hosting platform's environment variable settings.

In the 'Required Keys' input, enter the variable names you expect to be present, separated by commas or newlines (e.g. DATABASE_URL, API_KEY, PORT). The tool will flag any required key that is missing from the pasted .env content, helping you catch forgotten variables before deploying to a new environment.