Configuration parity without secret exposure
.env File Comparator & Validator — Find Missing and Duplicate Keys
Compare .env files locally, identify missing, extra, empty, duplicate, and changed keys, and keep values hidden unless you deliberately reveal them.
Key parity matrix
| Key | Development | Staging | Production | Action |
|---|---|---|---|---|
| API_URL | present | present | present | value differs |
| LOG_LEVEL | present | missing | present | add to staging |
| DEBUG | present | present | extra | review production |
| DATABASE_URL | empty | present | present | fill development |
Parser edge cases
There is no single dotenv specification shared by every loader.
NAME=value # noteInline comment rules differ
export NAME=valueAccepted by some loaders
MULTILINE="one\ntwo"Quoted newline semantics differ
NAME=value
NAME=againDuplicate precedence must be visible
The effective value depends on the loader order
- 1Process environment
- 2Mode-specific file
- 3Local override file
- 4Base .env file
- 5Application default
The exact order varies by framework and deployment platform. Select a dialect for syntax checks, then verify precedence against the runtime that will actually load the file.
A shareable report should reveal status, not secrets
DATABASE_URL=postgres://name:password@host/dbDATABASE_URL · present · changed · value redactedSecret-looking key names are a review signal, not proof that the value is sensitive or already leaked.
Generate an example file, then review every placeholder
1 · Parse
Preserve comments and key order where possible.
2 · Redact
Replace values; do not copy credentials.
3 · Annotate
Describe required format and safe defaults.
4 · Review
Remove private hostnames and operational hints.
Before deployment
- All required keys exist
- No required value is empty
- Duplicate keys are resolved
- Environment-only extras are intentional
- The runtime precedence order is documented
Environment file questions
- Does a matching key set mean two environments are equivalent?
- No. It only proves parity of names. Values, infrastructure access, loader order, and application defaults can still differ.
- Should .env.example contain real values?
- Use reviewed placeholders and clearly safe defaults. Never assume automatic redaction catches every credential, hostname, or account identifier.
- Why do duplicate variables matter?
- Many loaders use the first or last occurrence, so a duplicate can hide the value a developer thinks is active.