Paste a .env file or open one. Each line is checked as you type.
Runs entirely in your browser. Your file and its secrets are never uploaded.
This ENV file validator checks a .env file line by line and tells you exactly what will break, what might break, and what’s just untidy. It reads the file the way dotenv does, then flags anything Docker, Docker Compose or a shell would read differently. Click any issue to jump straight to that line, see the final value of every variable, and download a cleaned copy with the bad lines removed.
How to check a .env file
- Paste your file into the left box, open it with Open file, or drag it onto the box. Files like
.env.localand.env.productionwork too. - Results show up as you type. The badge at the top tells you if the file is valid, and line numbers turn red or amber where there’s a problem.
- Click an issue in the Issues tab to highlight that line in your file.
- Open Variables to see the value each key actually loads as, including multi-line values and anything cut off by a
#. - Open Cleaned to copy or download a fixed file. Turn on Hide values first if you’re sharing your screen.
What the validator checks
| Check | Example | Level |
|---|---|---|
Line has no = | REDIS_URL | Error |
| Name starts with a number or has spaces or symbols | 2FA_KEY=x | Error |
| Invisible characters pasted into a name | API_KEY=x | Error |
| Quote opened but never closed | MSG="Hello | Error |
| Duplicate keys with different values | APP_ENV set twice | Warning |
Unquoted # that cuts the value short | PASS=abc#123 | Warning |
Spaces around = | PORT = 3000 | Warning |
| Dots or dashes in a name | api-key=x | Warning |
Text after a closing quote, curly quotes, KEY: value syntax | A="x" y | Warning |
| References to variables that aren’t defined | ${DB_USER} | Tip |
| Unquoted spaces, inline comments, empty values, lowercase names | NAME=My App | Tip |
| Multi-line values, Windows line endings, byte-order mark | KEY="line 1… | Tip |
Errors are lines that won’t load at all, or will load as something you didn’t mean. Warnings usually point to a real bug, like a password that’s silently cut short. Tips are things that work in dotenv but can trip you up somewhere else.
Why the same .env file works in one place and not another
There’s no official .env standard. Each tool parses the file a little differently, which is why a file that works locally can fail in a container or a deploy script.
| Line | dotenv (Node, Python) | Docker --env-file | Shell source |
|---|---|---|---|
PORT = 3000 | 3000 | Rejected (space in name) | Runs a command, fails |
PASS=abc#123 | abc | abc#123 | abc#123 |
T=30 # sec | 30 | 30 # sec | 30 |
NAME=My App | My App | My App | Runs App, fails |
KEY="a" | a | "a" with the quotes | a |
api-key=x | Works | Works | Error |
The validator treats dotenv as the baseline, since it’s what most apps use, and warns you wherever the other two disagree. If your file only needs to work with dotenv, you can safely ignore most tips.
What the cleaned file changes
- Removes lines with errors and keeps only the last copy of any duplicate key, which is the one dotenv and Docker would use anyway.
- Rewrites
KEY = valueandKEY: valueasKEY=value, and strips indentation, trailing spaces, Windows line endings and the byte-order mark. - With Quote risky values on, wraps values that contain spaces or a
#in quotes so every tool reads them the same way. - Keeps your comments and section spacing unless you turn off Keep comments or sort the keys A–Z.
It never changes the values themselves, and quoted values (including multi-line keys and certificates) are copied exactly as written.
Is it safe to paste secrets here?
Yes. Everything runs in your browser with JavaScript. Nothing is uploaded, logged or stored on a server, and the tool works with your network disconnected once the page has loaded. Your options (like Hide values) are saved in your browser, but your file content isn’t. For extra caution with production secrets, turn on Hide values or swap real secrets for placeholders before pasting.
Frequently asked questions
Do values in a .env file need quotes?
Not usually. KEY=value is fine for simple values. Use quotes when a value has spaces, a #, or spans multiple lines. Double quotes let you use \n for a new line and ${VAR} references. Single quotes keep everything literal, which is the safest choice for passwords containing $.
Which value wins if a key appears twice?
In dotenv and Docker, the last one in the file wins. The validator marks the earlier copies so you can delete them, and the cleaned file keeps only the last one.
Why is my password cut off at the # sign?
dotenv treats an unquoted # as the start of a comment, so PASS=abc#123 loads as abc. Wrap it in quotes, like PASS="abc#123", and the full value loads.
Can variable names have dashes or dots?
dotenv will accept them, but shells, Docker Compose substitution and many frameworks won’t. Stick to letters, numbers and underscores, and don’t start with a number.
How do I add a multi-line value like a private key?
Wrap the whole value in double quotes and keep the line breaks, or put it on one line with \n where each break goes. Both work in dotenv. Docker’s --env-file doesn’t support multi-line values, so use the \n version if you need it there.
Is export KEY=value allowed?
Yes. dotenv ignores the export prefix, and it lets you source the same file in a shell. The validator accepts it and keeps it in the cleaned file.
Does it check that my values are correct?
It checks the format, not the meaning. It can’t tell if a database URL or API key actually works, but it will catch the syntax problems that stop those values from loading the way you expect.