Environment Variables Validator

Yes — this tool runs entirely in your browser using JavaScript. Your environment variables are never sent to any server, stored, or logged. The validation logic executes locally on your machine. You can verify this by opening DevTools → Network tab and confirming no network requests are made when you paste content. That said, always be mindful when copying secrets to any web interface, even offline-capable ones. If you're validating highly sensitive production secrets, consider running the validation logic locally from the source code instead.

This tool flags common placeholder and weak values for keys that look like secrets (keys containing SECRET, KEY, TOKEN, PASSWORD, PASS, CREDENTIAL, AUTH, PRIVATE, CERT, SALT, or SEED). Flagged weak values include: test, password, password123, 123456, secret, changeme, example, placeholder, xxx, your_key_here, replace_me, todo, fixme, and empty values. These are commonly used as placeholders during development and should always be replaced with strong random values before deploying to production. Use a secrets manager like AWS Secrets Manager, HashiCorp Vault, or Doppler for production credentials.

The tool validates several .env format rules: (1) Every non-comment line must have an = sign separating the key from the value. (2) Key names should match [A-Za-z_][A-Za-z0-9_]* — letters, digits, and underscores only, starting with a letter or underscore. (3) No spaces around the = sign. (4) Values containing spaces must be wrapped in double or single quotes (VAR="hello world"). (5) Quotes must be properly closed. (6) Duplicate keys are flagged as errors — the second definition may silently override the first depending on your runtime. (7) Empty values (VAR=) are flagged as warnings.

Any key whose name contains the words SECRET, KEY, TOKEN, PASSWORD, PASS, CREDENTIAL, PRIVATE, AUTH, CERT, SALT, or SEED is treated as a secret. The tool masks the displayed value, showing only the first 2 and last 2 characters with **** in between (e.g., sk****89). This lets you verify the key is present and non-empty without exposing the full value in the results table. The full value is still processed locally in memory for validation (checking if it's empty or weak), but it is never displayed in full and never leaves your browser.