OneTaskBy Tim King · Updated
.env File Checker
Lint Duplicate Variables, Unclosed Quotes and Weak Secrets in a dotenv File
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the .env File Checker works
This env file checker reads a .env file and lists every line that could break your app or weaken its security. Paste the file to catch syntax mistakes, duplicate variables, placeholder values nobody replaced, short secrets and debug settings left on in production.
What the env file checker looks for
A .env file looks simple, but each loader reads it a little differently. Spaces around the equals sign become part of the name in some tools and break shell sourcing. An unclosed quote can swallow the next line. A duplicate name is resolved differently by dotenv, Docker and your shell, so the value you see may not be the one the app uses.
The checker flags invalid names, lower-case names, spaces around the equals sign, duplicates with the line of the first copy, unclosed quotes, unquoted values with spaces, multi-line values and empty values. It warns when a variable named like a password, token, key or salt holds a placeholder such as changeme or a value too short to be a strong secret.
If NODE_ENV, APP_ENV, RAILS_ENV or ENVIRONMENT says production, it also checks for DEBUG switched on and plain http URLs. The file is checked in your browser and never uploaded, but a real .env is still best kept out of chat, tickets and version control.
FAQ
Is my .env file uploaded?
No. The checks run in JavaScript on this page and nothing is sent or saved. You can still replace real secrets with dummy values of the same length before pasting, since the checks work just as well.
Should values be quoted?
Quote a value when it contains spaces, a # sign or special characters. Double quotes allow escapes like \n in most loaders and single quotes keep the text exactly as written. Plain values need no quotes.
Why does a duplicate matter if the app works?
Different loaders keep different copies. dotenv keeps the first, while a shell sourcing the file keeps the last, so the same file can give different settings in a script and in the app.
How long should a secret be?
Session secrets, signing keys and salts should be at least 32 random characters from a secure generator. Anything short or made of words can be guessed, which lets an attacker forge sessions or tokens.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Secret Scanner
Find leaked API keys, tokens and passwords in pasted code.
Git Secret Removal Guide
Step-by-step commands to purge a leaked secret from git history.
API Key Generator
Random prefixed API keys with an optional checksum, like GitHub tokens.
Password Strength Checker
Estimate a password's entropy, crack time and weak patterns.
AES Key Generator
Random AES-128, 192 or 256-bit keys in hex, Base64 or JWK.