Free Env File Checker
A deploy fails on a missing variable, or a placeholder secret ships to production. Compare your .env against its .env.example template before that happens.
Something not working?
Tell us what went wrong — it helps us fix the tool. Only what you type below is sent; your .env contents never leave your device. Never paste a real secret in the feedback box.
Need more power? Meet Env File Checker Pro
One-time payment. Yours forever. No subscription.
| Feature | Free | Pro |
|---|---|---|
| .env vs .env.example check, masked values, typo suggestions | Yes | Yes |
| Copy report, download clean template and filled draft | Yes | Yes |
| Compare three or more environments side by side | — | Yes |
| Value-format checks (URL, port range, key prefix) | — | Yes |
| Ads | Shown on page | Ad-free |
| Updates | — | Lifetime free updates |
Frequently asked questions
Are my secrets uploaded or stored?
No. Both files are parsed inside your browser and never leave your device. Values are masked by default, and the downloadable report contains key names only — no values at all. If you tick "Show values in full", they are shown on your screen only, still locally.
What counts as a placeholder value?
Values like change-me, your-api-key, xxx, <paste-key-here> or example. A key whose .env value still looks like the template's placeholder is flagged, because the most common "missing secret" bug is a placeholder that was never replaced.
What about export KEY=value, quotes and comments?
All handled: an optional export prefix, single- and double-quoted values, # comment lines, and trailing comments after unquoted values. A line with no = or an invalid key name is reported as malformed by line number only — its contents are never echoed back.
Can this replace a CI check?
For a quick manual check before deploying, yes. For every-pull-request enforcement, use a CLI validator in CI (for example npx ctroenv check). This page is the no-install version for the moment you are staring at two files wondering why staging broke.
What should I do if a real secret was ever pasted into an online tool?
Rotate it. Removing it from a page, a chat log or a repository does not revoke it — a key that left your machine must be treated as compromised until it is replaced at the provider.