Env Linter: Catch Duplicate Keys and Secret Drift
An env linter checks a dotenv file for mistakes that fail at runtime. Paste the file into the FindUtils Env Linter to flag duplicate keys, unquoted values with spaces, export prefixes, secret-looking values, and drift against an optional .env.example. Linting runs in your browser. The file is not executed.
A dotenv file looks simple. One duplicate key or one unquoted space can change what your process loads. The linter reports issues. It does not rewrite the file.
Why Lint a .env File
Small dotenv mistakes are hard to see in a text editor. The last duplicate key usually wins. An unquoted value with spaces can split. A key that exists only in .env.example never reaches the running app.
Lint a dotenv file when:
- A deploy fails on a missing variable. Compare
.envto.env.example. - Two keys share a name. The duplicate is easy to miss in a long file.
- A value contains spaces. The linter flags unquoted whitespace.
- You must review secrets without printing them. Secret-looking values are masked in the findings.
The honest limit: this is a lint for common dotenv files. It is not a full shell parser. It does not expand interpolation, and it does not source the file.
How to Lint a .env File Online
Paste the contents. Optionally paste .env.example. Read the issue list and the masked key table.
Step 1: Paste the .env file
Open the FindUtils Env Linter. Paste the file you want to check. Do not paste production secrets into a screenshot, a chat, or a public issue.
Step 2: Paste .env.example (optional)
Paste .env.example to see keys that are missing from .env and extra keys that are not in the example. That drift check is the fastest way to catch a forgotten variable.
Step 3: Lint
Click Lint. Read duplicate keys, unquoted spaces, export prefixes, invalid lines, and bad key names. Secret-looking values appear masked.
Step 4: Fix the file in your editor
The tool does not change your file. Quote values that contain spaces. Remove duplicate keys. Add missing keys. Keep the real secrets in your editor, not in a shared paste.
What the Linter Flags
| Finding | What it means | Typical fix |
|---|---|---|
| Duplicate key | The same key appears more than once | Keep one assignment |
| Unquoted spaces | The value has whitespace and is not quoted | Quote the value |
| Export prefix | The line uses export | Remove export for standard dotenv |
| Secret-looking value | AWS key, GitHub token, Slack token, private key, or a secret-like name | Review the key. The table masks the value |
| Missing in .env | The example has a key that .env lacks | Add the key locally |
| Extra in .env | .env has a key the example lacks | Add it to the example or remove it |
| Invalid line | The line is not KEY=value | Fix or comment it |
| Bad key | The name is not a valid env key | Rename it |
Secret masking covers AWS access keys, GitHub tokens, Slack tokens, private key armor, and keys whose names look like secrets. Masking is a display rule. It is not a guarantee that every secret is hidden.
Env Linter: Browser Lint vs a CI dotenv Action
A browser lint is for a file you already have open. A CI action is for a repository check on every push.
| Feature | FindUtils Env Linter | CI dotenv action | Desktop editor plugin |
|---|---|---|---|
| Price | Free, no signup | Free or paid runner time | Often free |
| Signup | No | Usually a git host | Editor install |
| File upload | No. Paste stays in the browser | The repo is already on the host | Local disk |
| Executes the file | No | No, if it is a lint action | No |
| Drift vs .env.example | Yes | Often yes | Depends |
| Masks secret-looking values | Yes | Depends | Rarely |
Best for: Use FindUtils for a quick local check before you commit. Use CI to stop a bad file from landing. Do not paste live production secrets into any shared form.
Practical Examples
Example 1: Duplicate DATABASE_URL
A local .env sets DATABASE_URL near the top and again at the bottom. The process uses the last value. The linter reports the duplicate so you keep one assignment.
Example 2: Unquoted redirect URL
APP_URL=https://example.com/path with space splits in some loaders. Quote the value. Lint again until the unquoted-spaces finding is gone.
Example 3: Example drift after a new feature
.env.example adds STRIPE_WEBHOOK_SECRET. Your local .env still lacks it. The missing-in-env finding names the key. You add a placeholder locally.
Common Mistakes
Mistake 1: Treating the linter as a secret scanner for the whole company
It flags common secret shapes and secret-like names. It does not replace a dedicated secret scanner or a vault.
Mistake 2: Pasting a production dump into a public chat after linting
The page does not upload the file. A screenshot of the key table can still leak names. Copy findings as key names, not values.
Mistake 3: Expecting every dotenv dialect to parse
export, multiline values, and interpolation vary by loader. This linter targets common KEY=value files.
Mistake 4: Using the tool as a formatter
It reports issues only. Fix the file in your editor. For JSON configs, use the JSON Formatter. For YAML, use the YAML Validator.
Tools Used in This Guide
- Env Linter — Lint dotenv files for duplicates, unquoted spaces, and example drift
- JSON Formatter — Validate and pretty-print JSON config
- YAML Validator — Check YAML structure
- JWT Decoder — Inspect a token locally when an env value is a JWT
FAQ
Q1: Is the env linter free? A: Yes. FindUtils Env Linter is free, with no signup. Linting runs in your browser.
Q2: Does this upload secrets? A: No. Linting runs in the browser. Secret-looking values are masked in the table. The page may still load analytics or ads.
Q3: What is the best free dotenv linter in 2026?
A: A useful free linter finds duplicate keys, unquoted spaces, and drift against .env.example without executing the file. FindUtils Env Linter does that in the browser.
Q4: Does it change my file? A: No. It reports issues only.
Q5: Can I compare two files?
A: Yes. Paste .env and .env.example.
Q6: Is this a parser for every dotenv dialect? A: No. It is a lint for common dotenv files, not a full shell parser.
Q7: Do I need an account? A: No. Paste the text and click Lint.
Next Steps
- Inspect a certificate or key block with the PEM Decoder
- Read is it safe to decode a JWT online before you paste tokens
- Validate structured config with the YAML Validator
- Return to the complete guide to online developer tools