Env File Generator

How to use the env file generator

1. Paste the contents of your .env file.
2. Read the findings; the public-prefix errors are the ones to act on first.
3. Pick an output — example file, TypeScript types or shell exports — and copy it.

About this tool

The recurring problem with environment files is not syntax. It is that the real file gets committed by accident and the example file goes stale, so a new joiner clones the repository and cannot start it. This addresses both: the example is derived from the real file rather than maintained by hand, and the checks name the mistakes that actually cause outages.

Values are blanked rather than invented. The optional shape hint describes what was removed — a database URL becomes `postgresql://user:password@localhost:5432/database`, an eighty-character key becomes `<80 characters>` — which documents the format without reproducing anything secret. Settings that are not secrets, like a port or a log level, can be kept as they are.

The check worth having is the public-prefix one. A variable beginning with `NEXT_PUBLIC_`, `VITE_` or `REACT_APP_` is compiled into the JavaScript sent to every visitor, which is the intended behaviour and a catastrophe when the name also contains "secret" or "key". That combination is reported as an error rather than a note, because it has leaked real credentials in real projects.

The other checks are quieter but real. A variable defined twice leaves it to the loader which one wins. An unquoted value containing a space is kept whole by some loaders and truncated at the space by others. A dollar sign in an unquoted value is expanded as a variable reference by some loaders, so a password can arrive different from how it was written.

Nothing typed here leaves the browser, which matters more for this tool than for most — the input is, by definition, a file full of credentials.

Common uses

• Producing a .env.example that matches the real file exactly.
• Generating TypeScript declarations so a missing variable fails at build.
• Checking a colleague's env file before a deployment.

Frequently asked questions

Why is a NEXT_PUBLIC_ variable flagged?

Because that prefix compiles the value into the JavaScript sent to every visitor. That is intentional for public values and a leak for anything private, so a name suggesting a secret is reported as an error.

Are my secrets uploaded anywhere?

No. The whole file is parsed in this browser tab and nothing is transmitted, which matters here because the input is a file of credentials by definition.

Why generate the example instead of writing it?

Because a hand-written template drifts from the file it documents, and the drift is discovered by whoever joins next and cannot start the project.