ENV Diff

Compare two .env files without leaking secrets

Diffing .env files in a chat window or a generic diff site is how production credentials end up in someone else’s logs. This tool parses two .env blobs entirely in your browser, masks every value by default, and shows you only what’s added, removed, or changed.

How it works

• Parsing. Each line is split on the first =. Blank lines and lines starting with # are ignored. Surrounding single or double quotes on values are stripped (so KEY="abc" and KEY=abc compare equal). Whitespace around the key and value is trimmed.
• Categories. A key in B but not A is added, a key in A but not B is removed, a key in both with different values is changed.
• Masking. Every value is rendered as •••••••• regardless of length until you click Reveal on a row, or Reveal values to unmask everything. Length is intentionally not exposed by the mask.
• Local only. Parsing and rendering happen in JavaScript on this page. No fetch, no XHR, no localStorage, no sessionStorage, no analytics on the values you paste.

Caveats

• Multi-line values aren’t supported. Each entry must fit on one line. .env files with literal newlines inside quoted values will be parsed as if the line breaks were record boundaries.
• Duplicate keys. If the same key appears more than once in a file, the last occurrence wins — same as most dotenv loaders.
• No interpolation. ${OTHER} references are not expanded; the value is compared as the literal string written in the file.