Is my .env file uploaded?
No. It is parsed on this page, held only in memory, and wiped when you leave. You can confirm it in the Network tab.
.env File Validator
Your values never leave this page.
Paste a .env file to catch the mistakes that break deploys: duplicate keys, empty values, bad quoting, and keys that drifted from .env.example. Findings name keys and lines, never values.
Loading the toolbox.
About 2dotenv
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your .env values stays here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your .env values.
- Click the clear icon in the Network tab so that the log is empty.
- Paste a .env, reveal the values, and generate an example.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and the tool keeps working.
Only two things can add a line to that log, and neither carries your .env values. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint, so a coding mistake could not quietly send your .env values elsewhere.
What Problems Does 2dotenv Find?
- Duplicate keys: loaders disagree about which value wins. Most keep the first, some the last, so a duplicate can change behavior between environments.
- Empty values: often a secret that was never filled in.
- Quoting problems: unbalanced quotes, unquoted values containing spaces, text after a closing quote, and trailing spaces inside quotes that become part of the value.
- Invalid keys: names that start with a digit or contain characters other than letters, digits, and underscores.
- Style: spaces around the equals sign, which shells reject, and mixed-case names.
How Does 2dotenv Protect Your Values?
A .env file usually holds the most sensitive strings in a project. 2dotenv follows the same rules as 2otp:
- No analytics events of any kind. The original version sent an event on every keystroke.
- Values are masked on screen by default, with a toggle to reveal them.
- Everything stays in this tab's memory and is never written to storage or the address bar.
- Input is wiped when you leave the tab, switch tools, or are idle for five minutes.
- Findings mention key names and line numbers only, so no value is ever echoed into the report.
The checks only need key names and quoting, so a copy with placeholder values works just as well, and is the habit the page recommends.
Which .env Syntax Is Understood?
2dotenv follows the conventions shared by the common loaders, such as dotenv for Node and python-dotenv:
KEY=value, with optionalexportin front.- Single, double, and backtick quotes, and double-quoted values that span several lines.
- Full-line comments with
#, and inline comments after an unquoted value when preceded by a space.
The original parser called export KEY invalid and treated inline comments as values with spaces; both are fixed.
Why Keep a .env.example?
The example file documents every variable the app needs, with the values left blank, and is committed to the repository while the real .env is not. 2dotenv compares the two and lists keys missing from either side, then generates a new example from your .env that keeps comments and grouping and copies no values.
What Other Tools Are in the Checkers Lane?
- 2xml: Format, minify, and validate XML with line and column errors, namespace lint, and JSON conversion.
- 2jq: Try jq-style paths, pipes, select, length, and keys against JSON. A labeled subset, not full jq.
- 2ssh: Validate ssh_config or sshd_config, copy a hardened block, and compose the right ssh-keygen command.
- 2kbd: Press any key to see key, code, keyCode, location, and modifiers, with a copy-ready handler.
Elsewhere in the toolbox: 2uuid, 2gitignore, 2csp, 2htaccess, and more on the 2toolbox home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Which value wins when a key is duplicated?
It depends on the loader. Most keep the first definition and some keep the last, so remove the duplicate.
Should .env be committed?
No. Commit .env.example with blank values, and keep real secrets out of version control.
Does the generated example contain my values?
No. It contains keys, comments, and blank lines only.