Environment variables manager

Validate .env, convert formats, detect potential secrets, generate .env.example, and encrypt/decrypt content in browser.

Security warnings

  • DB_PASSWORD: key name looks sensitive

Encrypt / decrypt (browser AES)

Need more than a template?

Want a hand with the infrastructure side?

I set up CI/CD, Kubernetes and cloud platforms that keep releases routine.

DevOps engineering →

How to use the environment variables manager

Paste a .env file to check it, convert it to JSON, YAML or Docker's env format, generate a .env.example with the values removed, and see which entries look like secrets. A passphrase-based AES option encrypts and decrypts the text in your browser, so a file can be passed around without sitting in plain text.

  1. Paste your .env content. Lines that are not KEY=value, or keys with invalid characters, are reported.
  2. Read the security warnings. Then download the format you need: .env, .env.example, JSON, YAML or Docker env.
  3. To share the file, enter a passphrase and encrypt it. The recipient decrypts it with the same passphrase.

Worked examples

Secret detection

DATABASE_URL=postgres://u:p@db:5432/app
API_KEY=sk_live_abcdefghijklmnopqrstuvwxyz123456
PORT=3000

# warnings
API_KEY: key name looks sensitive
API_KEY: value looks like token/secret

The first block is the input; the warnings are what the tool reports. Its .env.example output is the same keys with empty values.

Mistakes to avoid

  • Committing the real .env

    Add .env to .gitignore before the first commit and commit the .env.example instead. A secret that reaches Git history stays recoverable even after you delete the file, so rotate it.

  • Trusting the detector

    It flags key names such as password, token and key, and long token-like values. That catches a lot but not everything, and it flags some harmless entries too. Treat it as a prompt to look, not a guarantee.

  • Carrying quotes into other formats

    The tool takes everything after the first = as the value, quotes included. If a value is written as "production", the quotes come with it into JSON or Docker output. Remove them first if you do not want them.

  • Using the AES option as a vault

    It is a convenient way to move a file between two people. It is not a replacement for a secrets manager such as AWS Secrets Manager or HashiCorp Vault, which add access control, audit logs and rotation.

Questions people ask

Is my .env sent to a server?
No. Parsing, conversion and encryption all run in your browser.
Why does Docker treat quotes differently?
The docker run --env-file format takes each line literally and does not strip quotes. Compose and dotenv libraries handle them differently, so check the target.

Related