Does the scanner prove that a .env file is safe to share?
No. It detects reviewed patterns and names, but custom formats, encoded values, and contextual secrets still require manual review.
.env Secret Scanner & Redactor
Inspect .env-family files for likely credentials, distinguish references from literal values, and create separate redacted and .env.example copies.
Local input limit: 5 MB · Processing timeout: 8 s
Review a .env file before sharing it
The file is parsed as inert text in a browser worker. Nothing is executed, expanded, requested, persisted, or uploaded.
.env input
.env review
.env review
Variables, reference/literal classification, secret findings, and separate export copies will appear here.
Did DecodeLens help?
Support the continued development of independent, browser-local developer tools.
Format-aware dotenv review
DecodeLens preserves dotenv structure, separates literal values from external references, and combines known credential shapes, sensitive variable names, and optional conservative entropy checks.
Detection and export boundaries
- Supports comments, export prefixes, unquoted values, single- and double-quoted values, inline comments, and multiline quoted values without expanding variables.
- Provider patterns and sensitive names are useful evidence, not proof that a value is valid, active, or exploitable.
- Entropy findings are intentionally low confidence and are not replaced by default.
- Generated copies preserve the original source separately and are never written back to the selected file.
- Always review the redacted copy manually; no scanner can guarantee that every secret was found.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Cloud & DevOps
Terraform State Inspector & Secret Scanner
Map terraform.tfstate resources, modules, providers, outputs, and possible credentials; download a separate non-operational redacted copy.
Open tool - Security & identity
Kubernetes Secret Decoder & Inspector
Decode Kubernetes Secret values, inspect nested credential and file formats, or build a masked-by-default YAML/JSON manifest locally.
Open tool - Security & identity
JWT Decoder & Parser
Parse JWT segments and inspect formatted Header, Payload, and Signature data locally.
Open tool - Developer Utilities
URL Parser & Builder
Inspect URL components and query parameters, edit them, and rebuild a valid URL.
Open tool
Create a support-safe .env copy
Load the example, review the database URL, provider token, named secret, and JWT findings, then compare the redacted and .env.example outputs.
Input
DATABASE_URL=postgresql://user:password@db/appSeparate copy
DATABASE_URL=[REDACTED_PASSWORD_1].env Secret Scanner FAQ
Are ${VAR} and secret-manager references treated as secrets?
Pure references are classified separately because they do not contain the literal value. The referenced system and variable name may still reveal operational information.
Does .env.example preserve comments and ordering?
Yes. It removes assignment values while preserving keys, comments, order, export prefixes, quote delimiters, and inline comments where supported.