---
url: https://findutils.com/guides/env-linter-guide
title: "Env Linter: Catch Duplicate Keys and Secret Drift"
description: "Lint a .env file in your browser. Find duplicate keys, unquoted spaces, export prefixes, and drift against .env.example. Secret values stay on your device."
category: developer
content_type: guide
locale: en
read_time: 6
status: published
author: "codewitholgun"
published_at: 2026-08-27T08:20:00Z
updated_at: 2026-08-27T08:20:00Z
excerpt: "Paste a dotenv file, compare it to .env.example, and read masked findings. The linter does not execute the file and does not upload it."
tag_ids: ["developer-tools", "dotenv", "env", "lint", "secrets"]
tags: ["Developer Tools", "Dotenv", "Env", "Lint", "Secrets"]
primary_keyword: "env linter"
secondary_keywords: ["dotenv linter online", "check .env file", "env.example drift", "duplicate env keys", "lint dotenv in browser"]
tool_tag: "env-linter"
related_tool: "env-linter"
related_tools: ["env-linter", "json-formatter", "jwt-decoder", "yaml-validator"]
og_image: "/images/content/guides/env-linter-masked-keys.webp"
image_alt: "Two columns of key-value cards sit side by side, with duplicate stacks and frosted masks over secret-looking values."
---

An env linter checks a dotenv file for mistakes that fail at runtime. Paste the file into the FindUtils [Env Linter](/developers/env-linter/) to flag duplicate keys, unquoted values with spaces, export prefixes, secret-looking values, and drift against an optional `.env.example`. Linting runs in your browser. The file is not executed.

A dotenv file looks simple. One duplicate key or one unquoted space can change what your process loads. The linter reports issues. It does not rewrite the file.

## Why Lint a .env File

Small dotenv mistakes are hard to see in a text editor. The last duplicate key usually wins. An unquoted value with spaces can split. A key that exists only in `.env.example` never reaches the running app.

Lint a dotenv file when:

- **A deploy fails on a missing variable.** Compare `.env` to `.env.example`.
- **Two keys share a name.** The duplicate is easy to miss in a long file.
- **A value contains spaces.** The linter flags unquoted whitespace.
- **You must review secrets without printing them.** Secret-looking values are masked in the findings.

The honest limit: this is a lint for common dotenv files. It is not a full shell parser. It does not expand interpolation, and it does not source the file.

## How to Lint a .env File Online

Paste the contents. Optionally paste `.env.example`. Read the issue list and the masked key table.

### Step 1: Paste the .env file

Open the FindUtils [Env Linter](/developers/env-linter/). Paste the file you want to check. Do not paste production secrets into a screenshot, a chat, or a public issue.

### Step 2: Paste .env.example (optional)

Paste `.env.example` to see keys that are missing from `.env` and extra keys that are not in the example. That drift check is the fastest way to catch a forgotten variable.

### Step 3: Lint

Click Lint. Read duplicate keys, unquoted spaces, export prefixes, invalid lines, and bad key names. Secret-looking values appear masked.

### Step 4: Fix the file in your editor

The tool does not change your file. Quote values that contain spaces. Remove duplicate keys. Add missing keys. Keep the real secrets in your editor, not in a shared paste.

## What the Linter Flags

| Finding | What it means | Typical fix |
|---------|---------------|-------------|
| Duplicate key | The same key appears more than once | Keep one assignment |
| Unquoted spaces | The value has whitespace and is not quoted | Quote the value |
| Export prefix | The line uses `export` | Remove `export` for standard dotenv |
| Secret-looking value | AWS key, GitHub token, Slack token, private key, or a secret-like name | Review the key. The table masks the value |
| Missing in .env | The example has a key that `.env` lacks | Add the key locally |
| Extra in .env | `.env` has a key the example lacks | Add it to the example or remove it |
| Invalid line | The line is not `KEY=value` | Fix or comment it |
| Bad key | The name is not a valid env key | Rename it |

Secret masking covers AWS access keys, GitHub tokens, Slack tokens, private key armor, and keys whose names look like secrets. Masking is a display rule. It is not a guarantee that every secret is hidden.

## Env Linter: Browser Lint vs a CI dotenv Action

A browser lint is for a file you already have open. A CI action is for a repository check on every push.

| Feature | FindUtils Env Linter | CI dotenv action | Desktop editor plugin |
|---------|----------------------|------------------|-----------------------|
| Price | Free, no signup | Free or paid runner time | Often free |
| Signup | No | Usually a git host | Editor install |
| File upload | No. Paste stays in the browser | The repo is already on the host | Local disk |
| Executes the file | No | No, if it is a lint action | No |
| Drift vs .env.example | Yes | Often yes | Depends |
| Masks secret-looking values | Yes | Depends | Rarely |

**Best for:** Use FindUtils for a quick local check before you commit. Use CI to stop a bad file from landing. Do not paste live production secrets into any shared form.

## Practical Examples

### Example 1: Duplicate DATABASE_URL

A local `.env` sets `DATABASE_URL` near the top and again at the bottom. The process uses the last value. The linter reports the duplicate so you keep one assignment.

### Example 2: Unquoted redirect URL

`APP_URL=https://example.com/path with space` splits in some loaders. Quote the value. Lint again until the unquoted-spaces finding is gone.

### Example 3: Example drift after a new feature

`.env.example` adds `STRIPE_WEBHOOK_SECRET`. Your local `.env` still lacks it. The missing-in-env finding names the key. You add a placeholder locally.

## Common Mistakes

### Mistake 1: Treating the linter as a secret scanner for the whole company

It flags common secret shapes and secret-like names. It does not replace a dedicated secret scanner or a vault.

### Mistake 2: Pasting a production dump into a public chat after linting

The page does not upload the file. A screenshot of the key table can still leak names. Copy findings as key names, not values.

### Mistake 3: Expecting every dotenv dialect to parse

`export`, multiline values, and interpolation vary by loader. This linter targets common `KEY=value` files.

### Mistake 4: Using the tool as a formatter

It reports issues only. Fix the file in your editor. For JSON configs, use the [JSON Formatter](/developers/json-formatter/). For YAML, use the [YAML Validator](/developers/yaml-validator/).

## Tools Used in This Guide

- **[Env Linter](/developers/env-linter/)** — Lint dotenv files for duplicates, unquoted spaces, and example drift
- **[JSON Formatter](/developers/json-formatter/)** — Validate and pretty-print JSON config
- **[YAML Validator](/developers/yaml-validator/)** — Check YAML structure
- **[JWT Decoder](/developers/jwt-decoder/)** — Inspect a token locally when an env value is a JWT

## FAQ

**Q: Is the env linter free?**
A: Yes. FindUtils Env Linter is free, with no signup. Linting runs in your browser.

**Q: Does this upload secrets?**
A: No. Linting runs in the browser. Secret-looking values are masked in the table. The page may still load analytics or ads.

**Q: What is the best free dotenv linter in 2026?**
A: A useful free linter finds duplicate keys, unquoted spaces, and drift against `.env.example` without executing the file. FindUtils Env Linter does that in the browser.

**Q: Does it change my file?**
A: No. It reports issues only.

**Q: Can I compare two files?**
A: Yes. Paste `.env` and `.env.example`.

**Q: Is this a parser for every dotenv dialect?**
A: No. It is a lint for common dotenv files, not a full shell parser.

**Q: Do I need an account?**
A: No. Paste the text and click Lint.

## Next Steps

- Inspect a certificate or key block with the [PEM Decoder](/developers/pem-decoder/)
- Read [is it safe to decode a JWT online](/blog/is-it-safe-to-decode-a-jwt-online/) before you paste tokens
- Validate structured config with the [YAML Validator](/developers/yaml-validator/)
- Return to the [complete guide to online developer tools](/guides/complete-guide-to-online-developer-tools/)