.env Formatter & Converter

Applications read configuration from environment variables, and during development those usually live in a .env file. When the app moves to Docker, Kubernetes or a CI pipeline, the same variables have to be written again in a different syntax — and every copy is a chance to mistype a key or leak a secret. This converter reads a .env file, checks it, and writes it in the format you need.

The .env syntax

There is no formal standard, but the popular dotenv libraries agree on the basics, and the parser follows them. Each line is KEY=value, optionally preceded by export. Blank lines and lines starting with # are ignored, and a # after an unquoted value starts a comment. Single-quoted values are taken literally. Double-quoted values understand escapes such as \n and may span several lines, which is how private keys and certificates are often stored.

Checks on the way

Every problem is listed with its line number. A line that is not KEY=value is an error. Names with characters other than letters, digits and underscores are flagged, because many shells and platforms reject them, and lower-case names get a gentle note since upper case is the convention. A key defined twice is the most common mistake: the tool keeps the last value, as most loaders do, and warns so you can remove the stale line.

Spotting secrets

Keys whose names contain words like PASSWORD, SECRET, TOKEN, KEY, PRIVATE, CREDENTIAL, AUTH or DSN are counted as likely secrets and named in a warning when you convert to a format that should not hold them, such as a ConfigMap or a Compose file committed to a repository.

The target formats

Docker Compose accepts environment variables as a map (PORT: "8080") or a list (- PORT=8080); both are offered, with values quoted where YAML would misread them. The docker run output gives one -e flag per variable, shell-quoted. Kubernetes gets a ConfigMap for plain settings or a Secret, whose values are base64-encoded as the API requires. The GitHub Actions output writes ordinary values directly and replaces likely secrets with ${{ secrets.NAME }} references, ready for repository secrets. JSON, shell export lines and PowerShell $env: assignments complete the set.

Base64 is not encryption

A Kubernetes Secret only encodes values; anyone who can read the object can decode them, as this tool does when you paste one back. Protect Secrets with role-based access control, enable encryption at rest in the cluster, or use an external secret manager.

A worked example

The sample defines PORT twice, so the checks report “PORT is defined twice (line 3)” and the output uses 8080. Seven variables remain, one of them — STRIPE_SECRET_KEY — flagged as a likely secret. In the Compose map, the database URL is quoted because it contains a colon, and as a Kubernetes Secret, PORT becomes ODA4MA==.

Converting back

The tool also reads the other formats: paste JSON, a Compose environment list, a ConfigMap or Secret, or a docker run command, and the variables are extracted so you can produce a clean .env or another target.

Related tools

Convert configuration files with the TOML Converter and YAML to JSON, decode or encode values with the Base64 Encoder, or tidy JSON settings in the JSON Formatter.