.env File Analyzer

About this tool

An env file holds the settings and secrets of an app, and a few small mistakes in it cause most of the leaks that could have been avoided. This tool parses the file the way the npm dotenv package does (comments, export, single and double quotes, escapes, values over several lines, inline comments, duplicate keys, ${VAR} references, a byte order mark, Windows line endings), then checks it. Secrets are found in two ways: the same rules as the Secret Scanner for documented token formats, and the key name (PASSWORD, SECRET, TOKEN, API_KEY, PRIVATE_KEY, DSN, passwords inside database URLs and more). The most serious finding is a secret behind a public prefix such as NEXT_PUBLIC_, VITE_, REACT_APP_, PUBLIC_, EXPO_PUBLIC_, GATSBY_ or NUXT_PUBLIC_: those variables are copied into the JavaScript every visitor downloads. Keys that are public by design (publishable keys, site keys, anonymous keys) are not flagged, and API keys under a public prefix are marked as heuristics because some, like Firebase web keys, are meant to be public. Other checks cover debug and development flags (APP_DEBUG, DEBUG=*, NODE_ENV=development in a production file, disabled TLS checks), weak, placeholder and empty secrets, short or low-entropy signing secrets, the same value used for several secrets, plain http endpoints, localhost and private addresses in a production file, and duplicate keys. In an .env.example file the tool looks for real-looking secrets, which is where such leaks usually hide because example files are shared. Findings that rest on guesses are labelled heuristic. Values are masked everywhere (first and last two characters for long values, only the length for short ones); the table has a switch to show them on screen, and the Markdown report always stays masked. The redacted copy replaces the values of secret keys with REDACTED and keeps the rest, so you can share the file to ask for help. Other loaders differ from dotenv: python-dotenv and Docker Compose only end a value at a space plus #, python-dotenv decodes more escapes, and Docker Compose and dotenv-expand substitute ${VAR}. The report points out where your file would be read differently. Nothing is uploaded, and the file never leaves your browser.

How to use it

1. Paste the file, or drop it on the page. Pick what kind of file it is, or leave detection on (the file name and a NODE_ENV or APP_ENV of production are used).
2. Press Analyse and read the findings from the top, starting with critical and high.
3. Check the key table. Values are masked; use the switch to see them on screen when nobody is watching.
4. Copy the Markdown report, or copy or download the redacted file to share it safely. Rotate any secret that was ever shared.

Common problems

A key is marked as a secret but it is not

Matching by name is a guess. Public identifiers and keys meant for browsers can have secret-sounding names. Findings marked heuristic are the least certain. Check the provider's documentation for the key.

A value is cut short at a #

dotenv ends an unquoted value at any #. Put the value in quotes, for example KEY="abc#def", so every loader reads the same text.

The result differs from my framework

This tool follows dotenv (npm). Frameworks that expand ${VAR} (dotenv-expand, Docker Compose, Vite, Next.js) or read quotes differently may give another result. The loader differences finding lists the lines that are affected.