Env File Sanitiser
Remove the secret values from a .env file and keep the keys, so you can commit or share a template safely.
Strip the secrets out of a .env file and keep the keys, so you can share a safe template.
What is in this file
Variables
5
Secrets
3
Public
1
Values that will be stripped
DATABASE_URL, JWT_SECRET, STRIPE_SECRET_KEY
Everything runs in your browser and nothing is uploaded. A key sitting behind NEXT_PUBLIC_ or VITE_ is already bundled into your JavaScript and visible to anyone, so it is kept as is.
# Database
DATABASE_URL=your_database_url_here
# Auth
JWT_SECRET=your_jwt_secret_here
STRIPE_SECRET_KEY=your_stripe_secret_key_here
NEXT_PUBLIC_SITE_URL=https://devkittools.online
DEBUG=your_debug_hereAbout the env file sanitiser
Committing a real .env is one of the most common ways credentials leak, and writing the example file by hand means it drifts out of date the moment someone adds a variable. Generating it from the real file keeps the two in step.
Everything runs in your browser, which matters more here than almost anywhere else on this site: a tool that asked you to upload a file full of production credentials would be the wrong tool no matter what it promised.
How to use it
- 1Paste the contents of your .env file.
- 2Choose how values should be replaced.
- 3Leave public prefixes kept, since those values are already shipped to the browser.
- 4Copy the result into .env.example and commit that instead.
Questions
Is my file uploaded?
No. It is processed entirely in your browser and never transmitted. Even so, if a secret has ever been committed, rotate it rather than just removing it.
Why are NEXT_PUBLIC_ values kept?
Anything behind NEXT_PUBLIC_, VITE_, PUBLIC_ or REACT_APP_ is compiled into your JavaScript bundle and visible to every visitor. It is not a secret, so hiding it in the example file only makes setup harder.
What already leaked if I committed a .env?
Assume everything in it is public, even after deleting the file, because git keeps the history. Rotate every key and check whether the repository was ever public or forked.
Which keys are treated as secrets?
Any key containing SECRET, KEY, TOKEN, PASSWORD, CREDENTIAL, PRIVATE, DSN or DATABASE_URL is flagged in the report. Values are stripped regardless unless the key has a public prefix.