Paste a .env file to catch duplicate keys, missing equals signs, unquoted values with spaces, and values that look like live credentials. Nothing is ever uploaded.
Findings
How it works
Each line is checked against a set of rules — a missing "=" sign, a key containing whitespace or non-conventional characters, a key already seen earlier in the file, and an unquoted value containing a space — plus a list of regex patterns that recognize the shape of common credentials like AWS keys, GitHub tokens, and JWTs.
FAQ
Why is a duplicate key treated as an error rather than just a warning?
It's not invalid syntax on its own, but most .env loaders silently keep only one of the duplicate values — often whichever was parsed last — which can quietly override a value you meant to keep. Flagging it as an error surfaces that risk instead of letting it fail silently.
Why does it flag something like an sk-... or ghp_... value even if it's fake placeholder text?
The checker only pattern-matches known credential shapes — AWS AKIA keys, GitHub ghp_ tokens, sk- prefixed secrets, Slack xox tokens, PEM private key headers, and JWTs. It has no way to tell a live credential from placeholder text that happens to match the same format, so it flags any string with that shape.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.