---
title: ".env Parser"
description: "Splits dotenv-format content into a key/value table. Masks sensitive fields."
url: https://sade.dev/en/tools/env-parser/
lang: en
author: "Muhammet Şafak"
published: 2026-04-06
updated: 2026-08-30
section: Tool
tags: ["env","config","devops"]
---

# .env Parser

> Splits dotenv-format content into a key/value table. Masks sensitive fields.

`.env` files look "simple," but there are **meaningful differences** between parser
implementations. This tool runs a parser that follows the common conventions
(php-dotenv, node-dotenv, godotenv) in broad strokes, but it is stricter in three
places: keys must match `[A-Za-z_][A-Za-z0-9_]*`, so `APP.NAME` and `MY-VAR` are
rejected; `${VAR}` interpolation is not applied; and input is parsed line by line,
so a value cannot span real line breaks.

## Supported patterns

- `KEY=value` — the basic form.
- `KEY="value with spaces"` — double-quoted; resolves `\n`, `\r`, `\t`, `\\`, `\"` escapes.
- `KEY='value'` — single-quoted; raw, no escapes.
- `export KEY=value` — the `export` prefix is dropped for bash compatibility.
- `# comment line` or `KEY=value # inline comment` (only for unquoted values, and only
  when a space precedes the `#`).
- `KEY=` — empty value.

## Common mistakes

- **Spaces around `=`**: `KEY = value` — php-dotenv, node-dotenv, godotenv and this
  tool all parse this fine; the spaces are trimmed away. The conventional form is still
  `KEY=value`, so stay on the safe side: no spaces around `=`.
- **Unquoted spaces**: `KEY=hello world` — is the whole value taken, or is the line an
  error? It depends on the parser: node-dotenv and godotenv read `hello world`, while
  php-dotenv rejects the line with "unexpected whitespace". **Always use quotes.**
- **Multi-line values**: php-dotenv, node-dotenv and godotenv all accept real line
  breaks inside double quotes; this tool does not — it parses input line by line, so
  write multi-line values with `\n` escapes here.

## Masking sensitive values

The tool masks the values of keys containing one of the words `key`, `secret`, `token`,
`password`, `pwd`, `auth`, `credential`. This is for **appearance** only — not real
protection. Pasting `.env` content into a browser exposes sensitive values to:

- Browser history,
- Clipboard,
- Screen sharing,
- Browser extensions.

This tool does **not** send sensitive values anywhere, but even so, **don't paste your
production secrets here**. Work with dummy/test data.

## Privacy

All parsing happens in your browser. Your data never leaves it.