Configuration
Secure .env Formatter
Sort keys, strip duplicates, and normalize syntax — entirely in your browser. Sharp edges. Zero radius. No server.
Clean output · 4 keys · 1 duplicate resolved
API_URL=https://api.example.com/v2 DATABASE_URL=postgres://user:pass@localhost:5432/db FEATURE_FLAG=true WELCOME_MESSAGE="Hello world"
Diagnostics
- L2 · WARNING · Space after "=" — will be trimmed unless the value is quoted.
- L4 · INFO · Duplicate key "API_URL" — later declaration wins.
- L6 · WARNING · Value for WELCOME_MESSAGE contains spaces and was unquoted — will be quoted in output.
About this tool
Why format .env in the browser?
Environment files often contain secrets. This utility sorts keys, keeps the last duplicate, quotes values that need it, and surfaces syntax diagnostics without uploading anything.
Messy .env files cause real outages: shadowed keys, unquoted URLs with #, and copy-paste drift between .env.example and local overrides. Cleaning them in a SaaS pastebin is a security smell. A client-side formatter keeps credentials on your machine while you normalize structure for Next.js, Vite, and Docker Compose workflows.
Deep dive
Safe dotenv hygiene for modern JavaScript apps
Sort, dedupe, then validate
Alphabetical keys make reviews and diffs readable. Duplicate keys almost always mean an accidental paste — dotenv loaders typically keep the last assignment, which can silently change which database URL your app uses. This tool applies that “last wins” rule explicitly so you see the surviving value, then flags lines that look syntactically broken before you commit.
What stays local — and what you should still never commit
Formatting does not encrypt secrets. Keep production credentials in a vault or host env settings, commit only.env.example with placeholders, and rotate anything that may have leaked into chat or screenshots. Use this page when you need a clean, reviewable file — not as a substitute for secret management.
Pair with framework conventions: Next.js public vars need the NEXT_PUBLIC_ prefix; Vite usesVITE_. After formatting, verify those prefixes still match what your code reads at build time.
How to use it
Typical workflow
- Paste the contents of your local
.env(never share production secrets in screenshots). - Run format to sort keys, collapse duplicates, and review diagnostics.
- Copy the cleaned output back into your project or into
.env.examplewith values redacted. - Restart the dev server so process env picks up the new file.
FAQ
Frequently asked questions
Are my secrets stored?
No. Processing is in-memory in your tab. Refreshing the page clears the editor unless your browser restores form state.
Which duplicate wins?
Later declarations override earlier ones for the same key, matching typical dotenv “last wins” behavior.
Does this support multiline values?
Standard single-line KEY=value entries are the primary target. Complex multiline or export-prefixed shells may need manual cleanup after formatting.