Env Diff

Values in the result

Ignore key caseShow unchanged keys

Keys are matched by name after the dotenv rules are applied, so key order, quoting style and export prefixes never count as a change. Masking goes by key name: a key containing SECRET, TOKEN, PASSWORD, KEY, AUTH, PRIVATE, CREDENTIAL, SALT, DSN, COOKIE or SESSION is hidden.

Add two .env files, then press Compare

Paste or drop the older or template file on the left and the file to check on the right, for example .env.example and .env, or staging and production. Load sample shows every kind of difference.

Report

The report and both downloads use the same masking as the screen.

Runs in your browser; the files are not uploaded. Analytics and ads may load on the page.

Why Use Env Diff?

Most broken deploys that come down to configuration are one missing key: a variable someone added to their local .env and never put in .env.example, or a value that differs between staging and production. A plain text diff is noisy here, because two .env files rarely list keys in the same order, quote values the same way or keep the same comments. Env Diff parses both files with the dotenv rules and compares them key by key, so the list you get is only what matters: keys that exist on one side only and keys whose values differ. Secret-looking values are masked by default, so the result can go into a ticket or a screenshot.

Env Diff compares two dotenv files by key. Each side is parsed the way a dotenv loader reads it: blank lines and # comment lines are skipped, a leading export is removed, single, double and backtick quotes are unwrapped, backslash escapes such as \n are decoded inside double quotes, a double-quoted value may span several lines, and an inline # comment after an unquoted value is cut off. The values are then compared as plain strings, key by key, so the order of the keys and the quoting style never produce a difference on their own.

The result has three kinds of difference. A key found only in File B is added, a key found only in File A is removed, and a key found in both with a different value is changed, shown as old value, arrow, new value. Keys with the same value are counted as unchanged and listed only when Show unchanged keys is on. The list follows File A's key order, then the keys that exist only in File B. A key defined twice in one file keeps its last value, and a warning names every line it was on.

Values whose key name contains SECRET, TOKEN, PASSWORD, PASSWD, PWD, KEY, AUTH, PRIVATE, CREDENTIAL, SALT, DSN, COOKIE or SESSION, in any letter case, are masked by default. A masked value is replaced by up to eight dots and its length. Mask all values hides every value, and Show all values hides nothing. The copied report and the .txt and .json downloads carry the same masking as the screen. A line with no = sign, a key name dotenv does not accept, or a quote that never closes stops the comparison with a message naming the file and the line, instead of guessing a key.

Env Diff never expands ${VAR} references, never runs a command, and is not a secrets manager: it compares the two texts you give it. To combine the files, use Env Merge. To convert one into JSON or YAML, use the Env JSON Converter or the Env YAML Converter.

How it compares

A text diff such as Diff Checker compares two .env files line by line, so a reordered file, a switch from single to double quotes or a moved comment looks like a change. Env Diff compares the parsed keys and values instead, and reports each missing or changed key once. For structured config formats the same idea applies in JSON Diff and TOML Diff. Unlike an online converter that posts your file to a server, this page parses both files in your browser.

Tips for Comparing .env Files

Values are compared after the dotenv rules are applied, so APP_NAME="My App" and APP_NAME='My App' are the same value, and an inline # comment after an unquoted value is not part of it.
The default mask goes by key name, and also hides the password inside a connection URL such as postgres://app:password@db/app under any key. Other secrets under an innocent-looking key stay visible, so choose Mask all values before you share a screenshot.
A masked value keeps its length, for example ••••••••, 18 chars, so a changed secret still shows as changed.
If a key appears twice in one file, the last value is used, which is what dotenv loaders do, and the warning names both lines.
To combine the two files instead of comparing them, use Env Merge; to check one file for mistakes, use Env Linter.

Frequently Asked Questions

How do I compare two .env files?

Paste or drop the first file into File A and the second into File B, then press Compare. The page lists keys that exist only in B (added), keys that exist only in A (removed), and keys in both files whose values differ (changed), with a count for each and a count of unchanged keys.

How do I find variables missing from .env.example?

Put .env.example in File A and your .env in File B. Every key under Added exists in your .env but not in the example file, so those are the keys to add to the template. Keys under Removed are in the example but missing from your .env.

Does key order or quoting count as a difference?

No. Both files are parsed with the dotenv rules first, and keys are matched by name, so the order of the lines does not matter. A value is compared after its quotes are removed and escapes are decoded, so KEY=abc, KEY="abc" and KEY='abc' are equal. Comments and blank lines are ignored.

Which values are masked?

By default, values whose key name contains SECRET, TOKEN, PASSWORD, PASSWD, PWD, KEY, AUTH, PRIVATE, CREDENTIAL, SALT, DSN, COOKIE or SESSION, in any letter case. A masked value shows up to eight dots and its length. The password inside a connection URL (scheme://user:password@host) is hidden too, whatever the key is called, and the rest of the URL stays readable. Any other secret under a key name that does not look secret stays visible unless you choose Mask all values.

Are masked values still compared?

Yes. The real values are compared and only the display is masked, so a changed secret is listed as changed even though both sides show dots. The downloads use the same masking as the screen, and contain the real values only when Show all values is selected.

What happens to a key that appears twice in one file?

The last value wins, which is how dotenv loaders read a file, and a warning lists every line the key appears on and which line was used.

What does the error about a line with no = mean?

The named file has a line that is neither a comment, a blank line nor a KEY=value pair. The comparison stops and names the file and the line number instead of guessing a key. The same happens for a key name dotenv does not accept and for a quoted value that never closes.

Does it expand $VAR or ${VAR} references?

No. Values are compared exactly as written, references included, because expansion rules differ between dotenv libraries and shells. Nothing is executed.

Are my .env files uploaded?

No. Both files are parsed and compared in your browser, and the text is not sent in any request. Analytics and ads may load on the page as on the rest of the site. There is no API version of this tool on purpose, because .env files usually hold secrets.

Can I treat API_KEY and api_key as the same key?

Yes. Turn on Ignore key case. Keys are then matched without letter case, and if one file defines both spellings, the one written last is used.