What it is
A free, private diff for environment variables. It understands dotenv, export lines, quotes, multiline values, JSON and simple YAML.
Environment variable diff
Staging works. Production does not. Compare the env files.
Paste two env files and, if you have one, your .env.example. Env Diff lines them up key by key, keeps values masked, and points out missing keys, changed values, test keys in production, secrets exposed to the browser and placeholders nobody replaced.
- FEATURE_NEW_CHECKOUT=true + OPENAI_API_KEY=chan••••placeholder value ~ APP_URL=http••••••••plain http address ~ NEXT_PUBLIC_STRIPE_KEY=pk_l•••••••• STRIPE_SECRET_KEY=sk_t••••••••test or sandbox key JWT_SECRET=shar••••••••same secret in both
Who it is for
Developers shipping alone, release owners, DevOps people and anyone who has lost an evening to one missing key in production.
What it solves
Config drift. Code is reviewed and tested, env files usually are not, so a forgotten key or a test key in production slips straight through.
Compare two environments
Parsing and comparing happen in this tab. Nothing is uploaded, logged or stored.
dotenv, JSON or KEY: value lines.
dotenv, JSON or KEY: value lines.
Optional. Your .env.example, used as the list of keys every environment must have.
Values stay masked unless you turn them on. The report never contains values.
$ env diff ▌
Nothing compared yet
Paste two env files, or load the demo files to see every kind of finding.
Values never leave this page. The report and CSV list keys and findings only.
What each check means
Findings on environment B are treated as production. Secrets exposed to the browser count on either side.
Secret exposed to the browser
Prefixes like NEXT_PUBLIC or VITE ship the value inside your JavaScript bundle. Anyone can read it.
Test or sandbox key
Keys like sk_test take no real payments and send no real mail. Fine in staging, a quiet outage in production.
Points to localhost
A database, cache or API address that only works on a developer machine. In production it fails or reaches the wrong service.
Placeholder value
changeme, xxx, TODO or angle brackets. Someone copied the example and never filled it in.
Same secret in both
Staging and production share a secret, so a leak in staging opens production too.
Plain http address
A public address without https. Cookies, tokens and redirects can break or leak.
Debug switched on
Debug flags show stack traces and internals to visitors and slow everything down.
Very short secret
A secret, token or password under 12 characters is easy to guess.
Refers to a missing variable
The value uses a variable reference that is not defined in the same file, so it expands to nothing.
Empty
The key exists but has no value. Many libraries treat that as set and then fail in odd ways.
How to use it
Paste environment A
Usually staging or your local file. Rename the label to match your setup.
Paste environment B
Usually production. Export it from your host or copy it from your secret store.
Add the template
Optional. Paste .env.example to see which required keys are missing and which keys are undocumented.
Read the diff
Missing keys come first, then different values, then identical ones. Risky values are marked on every row.
Fix and share
Download a fresh .env.example with every key, and copy the report into the release checklist.
Good to know
- The checks look at names and value patterns. They cannot tell whether a key is actually valid at the provider.
- Shell features like command substitution are not run, only plain variable references are checked.
- YAML support covers flat KEY: value lines, not nested structures.
- Showing values only changes what you see on screen. Close the tab to clear everything.
Questions
Is it safe to paste real secrets here?
The page never sends what you paste anywhere, and the report has no values. Still, the safest habit is to rotate any secret that was ever pasted into a shared screen.
Why does B count as production?
Most people compare staging with production. Put the environment you are about to release in B and the risk checks apply to it.
What is the fingerprint?
A short SHA 256 of each value. It lets you see that two values differ without showing either of them.
Can it compare more than two files?
Compare them in pairs against the same template. The template keeps every comparison anchored to one list of keys.