ENV Diff Checker

Comparing a staging .env file against production, or today's deploy config against last week's, by eye is how real outages start: a missing DATABASE_URL, a PORT that quietly changed, an API key that got rotated in one environment but not the other. Pasting both files into a generic text diff does not help much either — it shows you which lines differ, not which environment variables actually changed, and it happily prints every secret value in plain sight the moment you share the output with a teammate.

This tool parses both files the way dotenv actually reads them — one KEY=value pair per line, # comments and blank lines ignored, single- or double-quoted values unquoted (with \n unescaped only inside double quotes, exactly as the dotenv convention specifies), and an optional export KEY=value prefix tolerated the way shell-sourced env files use it. Each file becomes a clean key-to-value map, and the two maps are then diffed by key: present only in File A is 'removed', present only in File B is 'added', present in both with a different value is 'changed', and identical values are 'unchanged' and hidden by default so the table stays focused on what actually differs.

The feature that makes this safe to actually use with real secrets is automatic masking. Every value shown in the diff table is checked against two independent signals: does its key name look like a secret (a case-insensitive match against KEY, SECRET, TOKEN, PASSWORD, PRIVATE or CREDENTIAL), or does the value itself have high Shannon entropy — the same information-theoretic measure (-Σ p(c)·log2(p(c)) over the value's characters) that flags API keys, tokens and random passwords as statistically different from ordinary words even when the key name gives no hint. Either signal is enough to mask a value down to its first and last two characters, computed independently for the old and new side of every changed row.

Everything — parsing, diffing, entropy scoring and masking — runs entirely in your browser; neither file, nor any value extracted from them, is ever sent anywhere. That is the right guarantee for a tool whose entire job is to look at two files that are likely to contain real database credentials, API keys and passwords side by side.