Find missing .env keys before they break production.
Paste two .envfiles and instantly see what's missing, empty, or different. Key-level diff — not line diff. Values stay in your browser.
How EnvDiff works
- 1
Paste your two .env files
Paste File A (usually .env.example or the reference file) in the left panel and File B (usually your actual .env) in the right panel. You can also swap them with the Swap button.
- 2
EnvDiff parses both files
Each file is parsed line by line. Comments (lines starting with #) and blank lines are skipped. Quoted values have their quotes stripped. The result is a map of key → value for each file.
- 3
Keys are compared — not lines
EnvDiff compares key sets, not raw text. If DB_HOST appears in both files but with different values, that's a mismatch — not a missing key. Reordered keys are handled correctly.
- 4
Issues are grouped into four categories
Missing in B (most critical), extra in B (undocumented keys), empty values (could be unset secrets), and value mismatches (different environments). Each category is colour-coded.
- 5
Copy missing keys in one click
The 'Copy as .env snippet' button generates a ready-to-paste block of all missing keys with empty values. Paste it into your .env and fill in the real values.
What each result category means
EnvDiff groups issues by type so you can prioritise — a missing key that crashes the app at startup is different from a key with a different value between environments.
Keys that exist in File A but are completely absent from File B. This is the most important category — if your app reads these variables on startup, it will crash or behave incorrectly.
# File A (.env.example) # File B (.env)
DATABASE_URL=... DATABASE_URL=postgres://...
JWT_SECRET=... # ← JWT_SECRET is missing
REDIS_URL=... REDIS_URL=redis://...Keys in File B that don't appear in File A. Usually this means someone added a variable to their local .env but forgot to document it in .env.example — it will be missing for the next person who clones the repo.
# File A (.env.example) # File B (.env)
DATABASE_URL=... DATABASE_URL=postgres://...
FEATURE_FLAG_NEW_UI=true # ← not in AKeys where the value is an empty string in one or both files. This catches unset secrets — a key might exist in .env so the app doesn't crash, but if the value is blank the feature won't work (empty API keys, empty DB passwords).
# File A (.env.example) # File B (.env)
STRIPE_SECRET_KEY=sk_... STRIPE_SECRET_KEY= # ← empty — will fail silentlyKeys present in both files with non-empty but different values. Usually expected (local vs staging DB URLs), but worth reviewing. Values are hidden by default — click 'Reveal values' to compare them.
# File A (.env) # File B (.env.staging)
DATABASE_URL=postgres://local DATABASE_URL=postgres://prod-host
API_URL=http://localhost:3000 API_URL=https://api.staging.comSupported .env syntax
EnvDiff handles the standard dotenv format used by Node.js, Python, Go, Ruby, and most frameworks.
# Comments are ignored (line must start with #)
SIMPLE_KEY=simple_value
# Quoted values — quotes are stripped in the parsed output
QUOTED_DOUBLE="value with spaces"
QUOTED_SINGLE='another value'
# Empty values — flagged as "empty values" in the diff
EMPTY_KEY=
EMPTY_QUOTED=""
# Keys with = in the value — safe, only first = is the separator
BASE64_KEY=abc=def==
# Blank lines are skippedNot supported: multi-line literal values (actual newlines inside quotes), export KEY=value prefix, and variable interpolation (${OTHER_VAR}).
When to use EnvDiff
| Situation |
|---|
| Onboarding a new developer |
| Pre-deployment check |
| After a PR adds new vars |
| Security audit (empty secrets) |
| Docker/Compose projects |
Frequently Asked Questions
What is .env.example and why should I keep it updated?
.env.example (sometimes .env.sample or .env.template) is a committed, safe-to-share version of your .env file with all keys present but values replaced with placeholders. It's the contract between your codebase and anyone deploying it.
When a developer adds a new environment variable, they should add the key (with an empty or placeholder value) to .env.example so teammates and CI know it exists. When that doesn't happen, things break silently — and EnvDiff is what you use to find the gap.
Does EnvDiff send my environment variables anywhere?
No. All parsing and diffing runs in JavaScript inside your browser. Nothing leaves your machine. The tool has no backend, no API calls, and no analytics on the values you paste.
What .env format does EnvDiff support?
EnvDiff handles the standard .env format used by dotenv (Node.js), python-dotenv, godotenv, and most frameworks:
KEY=VALUE— standard key-value pairs# comment— lines starting with#are ignoredKEY="value with spaces"— double-quoted values (quotes are stripped)KEY='value'— single-quoted values (quotes are stripped)- Blank lines — skipped
KEY=— empty value (flagged separately as an empty-value issue)
What does the 'Copy as .env snippet' button do?
When File A has keys that are missing from File B, the copy button generates a ready-to-paste .env snippet with those keys and empty values. You can paste it directly into your .env file and fill in the actual values.
For example, if DATABASE_URL and JWT_SECRET are missing from File B, the snippet is:
DATABASE_URL=
JWT_SECRET=How is this different from a regular text diff tool?
| Text diff (e.g. Unix diff) | EnvDiff | |
|---|---|---|
| Unit of comparison | Lines | Keys |
| Understands .env format | No | Yes |
| Handles reordered keys | Shows as changes | Correctly matched |
| Detects empty values | Only if value changed | Separate category |
| Hides sensitive values | Shows everything | Values hidden by default |
A regular diff shows DATABASE_URL=prod-host vs DATABASE_URL=localhost as a line change. EnvDiff shows them as "key present in both with different values" — which is a completely different kind of issue from a missing key.