Why .env files go wrong
A .env file holds environment variables for local development and container setups: database URLs, API keys, feature flags. It is read by dotenv for Node, python-dotenv, Docker Compose, Vite, Next.js, Laravel and Rails’ dotenv gem, and each of them is slightly different. The format looks trivial, NAME=value per line, yet small slips break it in ways that are hard to see: a space before =, a quote that is opened and never closed so the next ten variables become part of one value, a # that was meant as part of a password, or the same variable defined twice with the second silently winning.
Checking and tidying a file
Paste the contents or drop the file. When most lines look like UPPER_CASE=value the format is detected as dotenv automatically. The formatted file appears in the output pane; Ctrl/Cmd+Enter reruns it and Ctrl/Cmd+Shift+C copies it. The Table view lists each variable next to its parsed value, which is the quickest way to confirm what a multi-line key or an escaped quote really contains.
The built-in dotenv parser and printer follows the rules of python-dotenv and Docker Compose and runs in the page itself. That matters more here than almost anywhere: a .env is usually full of live credentials, and none of it is sent anywhere. If you later use the share link, PasteKit warns when the input looks like it contains secrets and offers to redact them; the guide to online formatters and secret leaks explains why that check exists.
Options
- Quote values controls quoting. As written leaves every value as it was. Only when needed removes quotes that serve no purpose (
SMTP_FROM="[email protected]"becomes unquoted) and adds double quotes to unquoted values containing spaces,#or quote characters. Always double quotes wraps every value in"…", escaping newlines, tabs, backslashes and inner quotes as needed. - export prefix: As written, Add export or Remove export. Adding it lets you
source .envin a shell and have the variables reach child processes. Removing it suits readers that take lines literally, such asdocker run --env-file, which does not understand the keyword. - Sort keys puts variables in alphabetical order. A comment directly above a variable moves with it, so section notes such as
# Stripestay attached to the right key.
One rule outranks the quote setting: a single-quoted or backtick value containing $ is never re-quoted. Single quotes are what stops dotenv-expand and Compose from interpolating $VAR, so turning 'Costs $5' into double quotes would change the value.
Parsing rules worth knowing
- Spaces around
=and before the name are removed, soDATABASE_URL = postgres://…becomesDATABASE_URL=postgres://…. Shells anddocker run --env-filechoke on that space, a classic cause of “variable is undefined” bugs. - In an unquoted value,
#starts a comment only when a space or tab comes before it.COLOR=#ff0000keeps its hash;LEVEL=debug # verbosehas the valuedebug. - Double-quoted values may span several lines, which is how PEM keys are usually stored, and they understand
\n,\t,\"and\\. Single-quoted and backtick values are taken literally. - Names must start with a letter or underscore and may contain letters, digits,
_,.and-. Lowercase names are allowed but get an info note, since the convention is UPPER_SNAKE_CASE. - A repeated variable produces a warning that points to the first definition.
Examples
Service config with stray spaces
Spaces around = and before LOG_LEVEL are removed, and the existing export prefix is kept.
DATABASE_URL = postgres://orders:s3cret@db:5432/orders
REDIS_URL=redis://cache:6379/0
LOG_LEVEL=debug
export SENTRY_DSN=https://[email protected]/42
DATABASE_URL=postgres://orders:s3cret@db:5432/orders
REDIS_URL=redis://cache:6379/0
LOG_LEVEL=debug
export SENTRY_DSN=https://[email protected]/42
Quotes only where they are needed
The email loses its pointless quotes, the unquoted sentence gains double quotes, and the single-quoted $5 label is left alone.
APP_NAME='Order Service'
SMTP_FROM="[email protected]"
FEATURE_FLAGS=checkout_v2,new_search
WELCOME_MESSAGE=Thanks for your order
PRICE_LABEL='Costs $5 per month'
APP_NAME='Order Service'
[email protected]
FEATURE_FLAGS=checkout_v2,new_search
WELCOME_MESSAGE="Thanks for your order"
PRICE_LABEL='Costs $5 per month'
Shell-ready file with export and double quotes
Every line gains export and a double-quoted value, so the file can be sourced from bash or zsh.
NODE_ENV=production
PORT=3000
API_BASE_URL=https://api.example.com/v1
export NODE_ENV="production"
export PORT="3000"
export API_BASE_URL="https://api.example.com/v1"
Sorted variables with a section comment
Variables are sorted alphabetically and the # mail comment travels with SMTP_HOST.
STRIPE_SECRET_KEY=sk_test_51abc
AWS_REGION=ap-southeast-1
# mail
SMTP_HOST=smtp.example.com
APP_URL=https://shop.example.com
APP_URL=https://shop.example.com
AWS_REGION=ap-southeast-1
# mail
SMTP_HOST=smtp.example.com
STRIPE_SECRET_KEY=sk_test_51abc
Common errors and how to fix them
| Error | Cause | Fix |
|---|---|---|
Unterminated double-quoted value for A starting at line 1Explained | A value opens with " and the file ends before a closing quote, so everything after it would be swallowed into one value. | Add the closing quote at the end of the intended value. For multi-line keys, make sure the last line ends with ". |
Invalid variable name '1BAD' on line 1 | The name starts with a digit or contains characters such as spaces or slashes that are not allowed in environment variable names. | Rename it to start with a letter or underscore, for example BAD_1. |
Missing '=' after A on line 1 | The line has a name followed by a space and more text but no equals sign, often a stray shell command such as source other.env. | Write it as NAME=value, or comment the line out with #. |
Unexpected text after the closing quote of A on line 1 | Only part of the value is quoted, as in A=“x” y, which loaders disagree about. | Quote the whole value, or start the trailing text with # if it is a comment. |
Duplicate variable 'A' (first defined on line 1) | The same variable is defined twice. Most loaders keep one of them, but not all agree which. | Delete the outdated line so each variable is defined once. |
Frequently asked questions
Should values in a .env file be quoted?
Only when they contain spaces, #, quotes or line breaks. Use single quotes when the value contains $ and must not be interpolated, and double quotes when you need escapes like \n.
Are spaces around the equals sign allowed?
python-dotenv and Node dotenv tolerate them, but docker run --env-file and some shells do not. The formatter removes them so the file works everywhere.
How do I store a multi-line private key in .env?
Wrap it in double quotes and keep the real line breaks, or put it on one line with \n escapes. Both forms are accepted and the Table view shows the decoded key.
Can I convert docker-compose environment YAML to .env?
Yes, use the YAML to .env converter, then format the result here.
Is it safe to paste production secrets?
The file is parsed in your browser and never uploaded. Still, avoid sharing links or screenshots of the output, and rotate any key that was exposed.