# envtools

> Free, fast, developer-first .env tools. Validate, generate, format, diff, and convert environment variables. No login. Runs locally.

Homepage: https://envtools.dev/
Sitemap: https://envtools.dev/sitemap.xml

## Free .env tools

- [ENV Validator](https://envtools.dev/env-validator): Validate .env files in seconds. Detect missing values, duplicate keys, invalid syntax, and empty variables. 100% client-side.
- [ENV Generator](https://envtools.dev/env-generator): Generate .env templates for Node.js, Next.js, Django, Rails, Laravel, and more. Ready-to-use boilerplates with sensible defaults.
- [ENV Formatter](https://envtools.dev/env-formatter): Format, align, and sort .env files automatically. Enforce naming conventions, remove duplicates, and keep configs clean.
- [ENV Diff Checker](https://envtools.dev/env-diff): Compare two .env files side by side. Instantly see added, removed, and changed variables between environments.
- [ENV to JSON](https://envtools.dev/env-to-json): Convert .env files to valid JSON instantly. Preserve types, handle nested keys, and export for any runtime.
- [JSON to ENV](https://envtools.dev/json-to-env): Turn JSON objects into valid .env files. Flattens nested keys automatically with configurable separators.
- [Secret Generator](https://envtools.dev/secret-generator): Generate a random JWT secret, session secret, or API key instantly. Cryptographically strong secrets for .env files. 100% client-side.
- [ENV Cleaner](https://envtools.dev/env-cleaner): Clean your .env file. Remove duplicates, empty values, comments, and trailing whitespace in one click.
- [ENV Leak Checker](https://envtools.dev/env-leak-checker): Scan your .env file for leaked API keys, exposed secrets, and compromised credentials. Checks AWS, Stripe, GitHub, OpenAI and 14 more patterns. Optional breach database lookup — your values never leave your browser.
- [ENV to Docker](https://envtools.dev/env-to-docker): Convert .env files to docker-compose env blocks, Dockerfile ENV instructions, or Kubernetes Secret YAML. Handles docker env file syntax automatically.
- [.env.example Generator](https://envtools.dev/env-example-generator): Turn any .env file into a safe .env.example template. Strips values while keeping keys and comments intact.
- [Missing ENV Detector](https://envtools.dev/missing-env-detector): Paste your .env and a list of required keys. Instantly see which variables are missing, empty, or extra.
- [ENV to YAML](https://envtools.dev/env-to-yaml): Convert .env files to YAML, GitHub Actions env blocks, or docker-compose environment maps. 100% client-side.
- [ENV Splitter](https://envtools.dev/env-splitter): Paste one combined .env file and split it by prefix (DEV_, PROD_) or by comment markers. Output multiple files ready to commit.
- [ENV Encrypt](https://envtools.dev/env-encrypt): Encrypt a .env with a passphrase before sharing. Uses AES-GCM via WebCrypto — keys never leave your browser.
- [ENV Merger](https://envtools.dev/env-merger): Merge .env.base with .env.local and environment overrides. Configurable precedence and conflict resolution.
- [Bcrypt Generator](https://envtools.dev/bcrypt-generator): Hash a password with bcrypt in your browser. Choose cost factor (rounds 10–14), verify an existing hash, and copy the result. Nothing is sent to any server.
- [Django Secret Key Generator](https://envtools.dev/django-secret-key-generator): Generate a cryptographically strong Django SECRET_KEY instantly in your browser. Matches Django's get_random_secret_key() charset. Nothing is uploaded.
- [ENV to Base64](https://envtools.dev/env-to-base64): Encode .env values to base64 or decode base64 back to plaintext. Useful for Kubernetes secrets, Docker envs, and CI/CD pipelines. All in-browser.
- [JWT Secret Generator](https://envtools.dev/jwt-secret-generator): Generate a random JWT secret key instantly — base64url-encoded, correct byte length for HS256, HS384, and HS512. 100% client-side, nothing uploaded.
- [Laravel APP_KEY Generator](https://envtools.dev/laravel-app-key-generator): Generate a Laravel APP_KEY (base64:... format) in your browser. Identical to php artisan key:generate. Nothing is uploaded or logged.
- [NextAuth Secret Generator](https://envtools.dev/nextauth-secret-generator): Generate a cryptographically strong AUTH_SECRET or NEXTAUTH_SECRET for Auth.js v5 and NextAuth v4. All in-browser — nothing is sent to any server.
- [OpenSSL Rand Generator](https://envtools.dev/openssl-rand-generator): Replicate openssl rand -base64 32 and openssl rand -hex in your browser. Choose byte count and encoding. No OpenSSL required — pure crypto.getRandomValues.
- [Rails Secret Key Generator](https://envtools.dev/rails-secret-key-generator): Generate SECRET_KEY_BASE and RAILS_MASTER_KEY for Ruby on Rails in your browser. Matches rails secret output. Nothing is uploaded.
- [Stripe Webhook Secret Generator](https://envtools.dev/stripe-webhook-secret-generator): Generate a Stripe webhook secret (whsec_... format), GitHub webhook secret, Shopify HMAC secret, or generic webhook secret in your browser. Nothing is uploaded.
- [Session Secret Generator](https://envtools.dev/session-secret-generator): Generate a cryptographically strong session secret for Express, Flask, CSRF tokens, and cookie signing. All in-browser — nothing is sent to any server.
- [API Key Generator](https://envtools.dev/api-key-generator): Generate a random API key, API secret, OAuth client secret, or admin secret instantly. Cryptographically strong, in-browser — nothing is uploaded.
- [Altcha HMAC Key Generator](https://envtools.dev/altcha-hmac-key-generator): Generate a cryptographically strong ALTCHA_HMAC_KEY for Altcha proof-of-work CAPTCHA. 256-bit hex key, generated in-browser — nothing is uploaded.
- [WordPress Salts Generator](https://envtools.dev/wordpress-salts-generator): Generate all 8 WordPress authentication keys and salts for wp-config.php — AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and their _SALT pairs. In-browser, nothing uploaded.
- [AES-256 Key Generator](https://envtools.dev/aes-256-key-generator): Generate a cryptographically strong 256-bit AES key for AES-256-GCM or AES-256-CBC encryption. Hex or base64, generated in-browser — nothing is uploaded.
- [Fernet Key Generator](https://envtools.dev/fernet-key-generator): Generate a Fernet key matching Python cryptography's Fernet.generate_key() format exactly — 32 bytes, urlsafe-base64. In-browser, nothing uploaded.

## Framework-specific .env generators

- [.env generator for Node.js](https://envtools.dev/env-generator/nodejs)
- [.env generator for Next.js](https://envtools.dev/env-generator/nextjs)
- [.env generator for Django](https://envtools.dev/env-generator/django)
- [.env generator for Ruby on Rails](https://envtools.dev/env-generator/rails)
- [.env generator for React (Vite)](https://envtools.dev/env-generator/react)
- [.env generator for Python (FastAPI / Flask)](https://envtools.dev/env-generator/python)
- [.env generator for Go](https://envtools.dev/env-generator/go)
- [.env generator for Docker Compose](https://envtools.dev/env-generator/docker)
- [.env generator for Kubernetes](https://envtools.dev/env-generator/kubernetes)
- [.env generator for Stripe](https://envtools.dev/env-generator/stripe)
- [.env generator for Firebase](https://envtools.dev/env-generator/firebase)
- [.env generator for Supabase](https://envtools.dev/env-generator/supabase)
- [.env generator for OpenAI](https://envtools.dev/env-generator/openai)
- [.env generator for Laravel](https://envtools.dev/env-generator/laravel)

## Specialist secret generators

- [NextAuth Secret Generator](https://envtools.dev/nextauth-secret-generator): Generate AUTH_SECRET / NEXTAUTH_SECRET for Auth.js and NextAuth v4
- [Django Secret Key Generator](https://envtools.dev/django-secret-key-generator): Generate Django SECRET_KEY matching get_random_secret_key()
- [Laravel APP_KEY Generator](https://envtools.dev/laravel-app-key-generator): Generate base64:-prefixed APP_KEY for Laravel
- [Rails Secret Key Generator](https://envtools.dev/rails-secret-key-generator): Generate SECRET_KEY_BASE and RAILS_MASTER_KEY for Ruby on Rails
- [JWT Secret Generator](https://envtools.dev/jwt-secret-generator): Generate HS256, HS384, and HS512 HMAC signing secrets
- [OpenSSL Rand Generator](https://envtools.dev/openssl-rand-generator): Replicate openssl rand -base64 and -hex in the browser
- [ENV to Base64](https://envtools.dev/env-to-base64): Encode .env values to base64 or decode base64 back
- [Bcrypt Generator](https://envtools.dev/bcrypt-generator): Hash and verify passwords with bcrypt, configurable cost factor

## Guides

- [What is a .env file? A developer's guide (2026)](https://envtools.dev/guides/what-is-env-file): A complete guide to .env files — what they are, how runtimes load them, why they matter, and how to use them safely across Node.js, Next.js, Django, and more.
- [10 .env best practices every team should follow](https://envtools.dev/guides/env-best-practices): Battle-tested rules for .env files: what to commit, what to rotate, how to structure secrets across dev, staging, and production, and the common mistakes that cause outages.
- [How to use dotenv: Node.js, React, Next.js, Rails, Django, webpack](https://envtools.dev/guides/how-to-use-dotenv): Every way to load a .env file — dotenv/config, the dotenv CLI, Node's --env-file flag, Create React App, Vite, Next.js, webpack, Django, Rails, Laravel, and Go. Load order and override rules included.
- [What is NEXT_PUBLIC_ in Next.js env variables?](https://envtools.dev/guides/next-public-env-variables): The NEXT_PUBLIC_ prefix decides whether an env variable is shipped to the browser or kept on the server. Here's how it works, when to use it, and the traps.
- [Hide .env from git (and recover if committed)](https://envtools.dev/guides/hide-env-from-git): Step-by-step: keep .env out of git from day one, and what to do when a secret leaks into your commit history. Includes rotation checklist.
- [How to fix .env file errors (complete troubleshooting)](https://envtools.dev/guides/fix-env-errors): The 12 most common .env file errors — missing values, duplicate keys, bad quotes, encoding issues, case sensitivity — with exact fixes for each.
- [GitHub Actions Secrets: How to Add, Use & Rotate Them (2026)](https://envtools.dev/guides/github-actions-secrets): Step-by-step: add a secret in Settings → Secrets, reference it with ${{ secrets.NAME }}, keep it masked in logs, and rotate it without breaking a run. Repo vs environment vs org secrets, plus OIDC as a secretless alternative.
- [Vercel Environment Variables: Setup, Sensitive Vars & CLI (2026)](https://envtools.dev/guides/vercel-environment-variables): How to add, pull, and manage environment variables in Vercel. Covers Production vs Preview vs Development, Sensitive environment variables (encrypted, runtime-only), vercel env pull, and the Vercel CLI.

## Comparisons

- [dotenv vs direnv: which env loader should you use?](https://envtools.dev/compare/dotenv-vs-direnv): dotenv loads .env inside your app at runtime. direnv loads per-directory env into your shell. Comparison of use cases, trade-offs, and when you want both.
- [.env vs a secrets manager (Doppler, Infisical, Vault)](https://envtools.dev/compare/dotenv-vs-secrets-manager): When does a plain .env stop being enough? Honest comparison of .env files against Doppler, Infisical, and Hashicorp Vault. Cost, setup, audit, rotation.
- [NEXT_PUBLIC_ vs VITE_: client env prefixes compared](https://envtools.dev/compare/next-public-vs-vite-env): Both Next.js and Vite inline prefixed env vars at build time. Same idea, different names, slightly different semantics. What to use when, and the gotchas.
- [.env files vs Kubernetes Secrets & ConfigMaps](https://envtools.dev/compare/env-vs-kubernetes-secrets): How .env files map to Kubernetes Secrets and ConfigMaps. When to split, when to combine, and how to avoid the classic base64-is-not-encryption trap.
- [dotenv vs config: which should you use in 2026?](https://envtools.dev/compare/dotenv-vs-config): An honest comparison of dotenv and config-based libraries (node-config, convict, zod-env). Trade-offs around validation, type safety, and schema enforcement.
- [.env vs JSON config: when to use which](https://envtools.dev/compare/env-vs-json-config): When .env wins, when JSON wins, and why most teams end up with a hybrid. Comparison of parsing cost, type safety, ergonomics, and CI/CD friendliness.
- [dotenv vs Doppler: when to upgrade from .env files](https://envtools.dev/compare/dotenv-vs-doppler): Plain .env files vs Doppler secrets manager — honest comparison of cost, setup complexity, team workflows, audit logs, and rotation. Includes Doppler alternatives.
- [HashiCorp Vault alternatives in 2026 (ranked by use case)](https://envtools.dev/compare/hashicorp-vault-alternatives): HashiCorp Vault is powerful but complex. Compare Doppler, Infisical, AWS Secrets Manager, and 1Password Secrets — so you can pick the right tool for your team size and budget.

## Blog

- [The .env file security checklist (15 items, 2026)](https://envtools.dev/blog/env-file-security-checklist): Everything you should check before pushing, sharing, or deploying a .env — from .gitignore entries to rotation policy. Printable 15-item checklist.
- [dotenv vs process.env in Node.js: the real difference](https://envtools.dev/blog/dotenv-vs-process-env-nodejs): dotenv is the library that loads a file. process.env is the global Node provides. They work together — here's where each starts and ends, with examples.
- [Environment variables playbook (2026)](https://envtools.dev/blog/environment-variables-playbook): What env vars actually are, how to set them across shells and frameworks, why they break production, and the 7 rules we follow after shipping too many broken deploys.
- [Where to store API keys: dev, staging, and prod (2026)](https://envtools.dev/blog/where-to-store-api-keys): Stop putting API keys in source code. A concrete playbook for local dev, staging, and production — with the exact tools and trade-offs for each tier.
- [How to share .env variables with your team](https://envtools.dev/blog/share-env-variables-with-team): A practical comparison of the five common ways to share environment variables — from 1Password Secrets Automation to encrypted file transfer — with real trade-offs.
- [The 10 most-forgotten .env variables](https://envtools.dev/blog/most-forgotten-env-variables): NODE_TLS_REJECT_UNAUTHORIZED, TZ, NEXT_TELEMETRY_DISABLED, and 7 more. The env vars developers forget to set that cause outages at the worst possible time.
- [How to validate a .env file: 5 ways (2026)](https://envtools.dev/blog/validate-env-file-complete-guide): From a one-line grep to full CI-time schema validation — every way to check a .env before it hits production, with code for Node.js, Python, and Go.
- [How to Avoid Committing Secrets to .env Files (2026)](https://envtools.dev/blog/how-to-avoid-committing-env-secrets): A prevention workflow, not a cleanup guide: pre-commit hooks, CI secret scanning, and the habits that stop a .env leak before git add ever runs.

## About envtools

envtools is a free, no-login suite of browser-based utilities for working with .env files. Every tool runs client-side; your .env never leaves your machine. Learn more at https://envtools.dev/about.