# .env Validator

> Check a .env file for duplicate keys, invalid names, quoting problems and undefined ${VAR} references. It runs in your browser and nothing is uploaded.

Canonical: https://host-tools.com/tools/env-validator/

---

## What this tool checks

Paste a `.env` file (or open it from disk) and it reports, line by line: invalid assignments,
invalid key names, duplicate keys, empty values, quoting problems, undefined `${VAR}` references
and a few things that are valid but surprising.

It is not a secret scanner. It does not look for API keys, and it does not send the file anywhere:
the content is parsed in your browser and never stored.

## The .env format is not one format

This matters more than it sounds. `.env` has no single specification, and different tools disagree:

- **dotenv (Node)** accepts multi-line values inside quotes; **Docker Compose** does not.
- Compose only expands `${VAR}`; a bare `$VAR` is left alone.
- Some parsers treat `#` as a comment start anywhere; in others only after whitespace.
- `KEY = value` with spaces works in some and fails in others.

This validator is explicit about the dialect it implements: the common subset shared by **dotenv
and Compose `env_file`**. When something falls outside it — multi-line values above all — it says
so instead of guessing. A validator that pretends to accept everything is worse than one that tells
you where its confidence ends.

## Why duplicate keys are the important one

```
DB_HOST=postgres
DB_HOST=redis
```

Nothing fails. No warning, no error at runtime: the last value simply wins, and the first line
becomes a lie that stays in the file forever. It is the most common cause of "but I changed the
variable and it still connects to the old host". This validator reports it as an error.

## Quoting changes the value

```
A=hello world      # value is: hello world
A="hello world"    # value is: hello world
A='hello world'    # value is: hello world
A="line1\nline2"   # double quotes: \n becomes a real newline
A='line1\nline2'   # single quotes: the backslash-n stays literal
```

Double quotes process escapes; single quotes are literal. Neither is wrong, but they are different,
and mixing them up is how a password with a `$` in it ends up expanded and shortened.

## References

`${VAR}` is expanded from the environment. If you reference a variable that is not defined in the
file, Compose and dotenv will substitute an empty string — which usually fails later, far from the
cause. The validator flags those references. References with a fallback (`${VAR:-default}`) are
accepted without complaint, because they define their own behaviour.

Once the file is clean, the [Docker Compose builder](/tools/docker-compose-builder/) can wire it
into a service with `env_file`.