# .env File Validator

> Check a .env file for syntax errors, duplicate keys, exposed secrets and missing entries.

A .env validator catches the mistakes that silently break configuration: duplicate keys where the last quietly wins, whitespace around the equals sign, unquoted values containing spaces or hash characters, and secrets given a NEXT_PUBLIC or VITE prefix that bundles them into client-side JavaScript.

**URL:** https://convertto.tech/t/env-file-validator
**Category:** Developer Tools (https://convertto.tech/c/developer-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Values that look like credentials are masked in the output and never leave your browser
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter or paste your .env file.
2. Enter or paste your .env.example (optional).
3. The result appears immediately — copy or download it.

## FAQ

### Why is NEXT_PUBLIC_SECRET_KEY dangerous?

Any variable with that prefix is inlined into the JavaScript bundle sent to every visitor. It is not hidden, obfuscated or protected — it is published. If a key must stay secret, it can only be used server-side.

## Related tools

- [.env to JSON Converter](https://convertto.tech/t/env-to-json): Convert .env files to JSON and back — for config migrations and CI variables.
- [INI & Config File Parser](https://convertto.tech/t/ini-parser): Parse INI, .conf, .cfg and .properties files into structured JSON, YAML or TOML.
- [JSON Merge](https://convertto.tech/t/json-merge): Deep-merge several JSON documents, choosing how arrays and conflicts are resolved.
- [7Z to ZIP Converter](https://convertto.tech/t/7z-to-zip): Convert 7-Zip (.7z) archives into universal ZIP format.
- [API Request Builder](https://convertto.tech/t/api-request-builder): Build an HTTP request visually and get it as curl, fetch, axios, Python, Go or PHP code.
- [Naming Convention Converter](https://convertto.tech/t/case-detector): Convert an identifier between every common naming convention at once.
- [Code Comment Remover](https://convertto.tech/t/comment-remover): Strip comments from six language families without breaking string literals.
- [Cron Expression Parser](https://convertto.tech/t/cron-expression-generator): Translate a cron expression into plain English and see when it will next run.