.env validator
Missing keys, placeholders and leaked secrets, plus a typed schema.Missing keys, leftover placeholders and leaked secrets, plus a typed schema for Zod or Pydantic.
Paste a .env, or load the sample files to see what it catches.
No problems found. Your files agree and nothing looks leaked.
How it works
Parses both files
A line-aware parser handles comments, export prefixes, quotes and multiline values, and reports what most loaders get wrong silently.
Compares and checks
Missing and undocumented keys, placeholders, duplicates, broken references, and credential formats from AWS, GitHub, Stripe and more.
Writes typed config
Infers each type and emits Zod, pydantic-settings and a clean .env.example, so bad config fails at startup instead of in production.
Common questions
Is it safe to paste a real .env here?
Nothing you paste leaves the page. There's no server call, no analytics on the inputs, no storage, and the values never go into the URL. Findings show values masked to their first four characters. If your policy says secrets never touch a browser, paste .env.example plus key names only; most checks still work.
What does it check?
Keys in .env.example missing from .env, keys in .env nobody documented, empty values, leftover placeholders like changeme, duplicates, invalid names, unquoted values with spaces, unclosed quotes, $VAR references to undefined keys, URLs without a scheme, bad ports, and real-looking credentials in .env.example, which is usually committed.
How are types inferred for the schema?
From names and values together: *_URL becomes a URL, *_PORT a port in 1 to 65535, true/false values and ENABLE_ or _ENABLED names become booleans, NODE_ENV and LOG_LEVEL become enums, and anything named like a key, token, password or secret becomes a required secret. Safe defaults come only from .env.example, never from .env.
How do I mark a variable optional?
Put the word optional in a comment on the line above it, or after it, in .env.example. It becomes .optional() in Zod and `| None = None` in Pydantic, and a missing value is reported as info instead of an error.
Config is where deploys break. Typed config, secrets management and CI checks that catch drift, set up end to end.
Talk to an engineerNew tools, when they ship. One email per tool.