.env vs .env.example Parity Checker — Find Config Drift
Paste your .env and .env.example to instantly find missing keys, empty values and undocumented extras. Values never leave your browser — only key names are compared.
Last reviewed 2026-10-19. Rates change — verify against the official sources linked below before relying on these figures.
What this is based on
- Only key names are compared — values are never displayed in results.
- Keys present in .env with an empty value count as drift (present but unfinished).
- Comment lines (#) and lines without '=' are ignored, matching dotenv conventions.
- Everything runs locally in your browser — pasted content is never uploaded, logged or stored.
Why env drift breaks deploys
The classic production incident: a developer adds STRIPE_WEBHOOK_SECRET locally, forgets to document it in .env.example, and the next deploy crashes because the key was never set in CI. The mirror image is just as common — keys documented in the example that nobody sets, leaving features silently disabled.
Key-parity checking catches both directions. Run it before every release, or wire the CLI version into a pre-commit hook or CI job so drift fails the build instead of the deploy.
Frequently asked questions
- Do my secret values get uploaded?
- No — the comparison runs in your browser and results show key names only. You can disconnect from the internet and the tool still works.
- What does 'extra in .env' mean?
- Keys set in your .env that don't appear in .env.example — undocumented configuration. Either add them to the example file or remove them; either way the example should reflect reality.
- What counts as 'empty'?
- A key with no value, or a literal "" or '' — usually a placeholder someone forgot to fill in.
Related calculators
Paste code or a git diff and detect leaked credentials — AWS keys, GitHub and Slack tokens, private key blocks, hardcoded API keys and JWTs. Matched values are masked, never displayed.
Paste a GitHub Actions workflow YAML and catch the top-5 CI/CD risks: unpinned actions, script injection, pull_request_target abuse, secrets in run steps and write-all permissions.
Paste a JWT and instantly see its header, claims and expiry — decoded entirely in your browser. No upload, no sign-up, nothing leaves your device.