Paste the file and optional required names. Sensitive-looking values are masked in the table by default, but copied JSON contains the original values.
Runs locally in your browserOptional: one variable name per line. Missing names are reported as errors.
Secret-like keys are masked by default. All parsing stays in your browser.
This page reads .env content line by line, lists the variables it found, and reports invalid names, duplicate keys, missing required names and likely secrets. Paste the file, list the names that must be present, then press Parse & validate. Everything runs in the browser: a parse in testing issued no network request at all, so a file that must not leave your machine can be checked here.
The result is a table of key, value, line and classification, a row of counters, and a findings list. Values whose names look secret-bearing stay masked as •••••••• until you tick Show values, but Copy JSON always writes the values as they appear in the file, so treat that clipboard content as sensitive.
Blank lines and lines whose first non-space character is # are skipped, and an export prefix is stripped, so export API_URL=... and API_URL=... behave the same way. The key is everything before the first =, trimmed, and it must start with a letter or underscore and continue with letters, digits or underscores: _PRIVATE is accepted while 9LIVES and A-B are reported as invalid names. The value is the rest of the line. A quoted value keeps its content, with double quotes decoding \n, \r, \t, \" and \\ and single quotes handling only \' and \\; an unquoted value drops a trailing “ # comment” and is trimmed. A # that is not preceded by a space stays part of the value, so A=a#b gives a#b, and references are not expanded: A=$HOME stays $HOME.
When a key appears twice, both lines are listed and the last value is the one that reaches the JSON, which the warning states. Keys are case-sensitive, so A and a are two different variables. Windows line endings and trailing spaces are read like clean LF input, and line numbers count every physical line of the file, including the skipped ones.
The decision is made from the name, not the value. Names containing password, passwd, pwd, passphrase, secret, token, api_key, access_key, ssh_key, signing_key, encryption_key, private, credential, dsn or webhook, and names that begin with auth or contain _auth, are classified sensitive. In testing that covered PWD, MYSQL_PWD, ACCESS_KEY, AWS_ACCESS_KEY_ID, SSH_KEY, SENTRY_DSN, SLACK_WEBHOOK_URL, ENCRYPTION_KEY and SIGNING_KEY, while AUTHOR and AUTHORITY stayed unmasked because they only spell the letters of auth.
Because it is a name test, secrets with unrelated names are still missed: DATABASE_URL, MONGODB_URI, REDIS_URL and STRIPE_SK were not masked in testing, even though a connection string usually carries a password. Use Show values to read them in the table, and remember that the copied JSON contains them either way.
It does not read a process environment or a file on disk, it does not reach the network, it does not check whether a value is valid, current or reachable, and it does not write anything back. Required names are compared literally, so a name that cannot occur as a key, such as A.B, is simply reported as missing.
Two parsing limits are worth knowing: an unterminated quote is kept literally instead of being reported, and a trailing backslash does not continue the line. Size is not a practical limit here: 2,000 variables parsed in about 0.3 s and a single 200,000-character value in about 0.2 s during testing.