--- title: "Env Diff" description: "Compare two .env files by key and see which variables were added, removed or changed. Secret-looking values are masked by default. Runs in your browser; the files are not uploaded." url: https://findutils.com/developers/env-diff/ category: developers --- # Env Diff Compare two .env files by key and see which variables were added, removed or changed. Secret-looking values are masked by default. Runs in your browser; the files are not uploaded. **Use this tool:** [Env Diff](https://findutils.com/developers/env-diff/) ## Programmatic access - Browser-only: this tool works on a file, the DOM, or a browser API and has no REST or MCP id. ## Why Use Env Diff? Most broken deploys that come down to configuration are one missing key: a variable someone added to their local .env and never put in .env.example, or a value that differs between staging and production. A plain text diff is noisy here, because two .env files rarely list keys in the same order, quote values the same way or keep the same comments. Env Diff parses both files with the dotenv rules and compares them key by key, so the list you get is only what matters: keys that exist on one side only and keys whose values differ. Secret-looking values are masked by default, so the result can go into a ticket or a screenshot. ## Frequently Asked Questions ### How do I compare two .env files? Paste or drop the first file into File A and the second into File B, then press Compare. The page lists keys that exist only in B (added), keys that exist only in A (removed), and keys in both files whose values differ (changed), with a count for each and a count of unchanged keys. ### How do I find variables missing from .env.example? Put .env.example in File A and your .env in File B. Every key under Added exists in your .env but not in the example file, so those are the keys to add to the template. Keys under Removed are in the example but missing from your .env. ### Does key order or quoting count as a difference? No. Both files are parsed with the dotenv rules first, and keys are matched by name, so the order of the lines does not matter. A value is compared after its quotes are removed and escapes are decoded, so KEY=abc, KEY="abc" and KEY='abc' are equal. Comments and blank lines are ignored. ### Which values are masked? By default, values whose key name contains SECRET, TOKEN, PASSWORD, PASSWD, PWD, KEY, AUTH, PRIVATE, CREDENTIAL, SALT, DSN, COOKIE or SESSION, in any letter case. A masked value shows up to eight dots and its length. The password inside a connection URL (scheme://user:password@host) is hidden too, whatever the key is called, and the rest of the URL stays readable. Any other secret under a key name that does not look secret stays visible unless you choose Mask all values. ### Are masked values still compared? Yes. The real values are compared and only the display is masked, so a changed secret is listed as changed even though both sides show dots. The downloads use the same masking as the screen, and contain the real values only when Show all values is selected. ### What happens to a key that appears twice in one file? The last value wins, which is how dotenv loaders read a file, and a warning lists every line the key appears on and which line was used. ### What does the error about a line with no = mean? The named file has a line that is neither a comment, a blank line nor a KEY=value pair. The comparison stops and names the file and the line number instead of guessing a key. The same happens for a key name dotenv does not accept and for a quoted value that never closes. ### Does it expand $VAR or ${VAR} references? No. Values are compared exactly as written, references included, because expansion rules differ between dotenv libraries and shells. Nothing is executed. ### Are my .env files uploaded? No. Both files are parsed and compared in your browser, and the text is not sent in any request. Analytics and ads may load on the page as on the rest of the site. There is no API version of this tool on purpose, because .env files usually hold secrets. ### Can I treat API_KEY and api_key as the same key? Yes. Turn on Ignore key case. Keys are then matched without letter case, and if one file defines both spellings, the one written last is used. ## Related Tools - [Env Merge](https://findutils.com/developers/env-merge/) - [Env Linter](https://findutils.com/developers/env-linter/) - [Env JSON Converter](https://findutils.com/developers/env-json-converter/) - [Env YAML Converter](https://findutils.com/developers/env-yaml-converter/) - [TOML Diff](https://findutils.com/developers/toml-diff/) - [JSON Diff](https://findutils.com/developers/json-diff/)