Compare environment variables without exposing their values

Direct answer

Can Diff Anything compare .env files without revealing secrets?

Diff Anything parses .env assignments by key, supports an export prefix and paired single or double quotes, ignores blank lines and comments, and reports missing or changed variables. Values are masked in the comparison. Duplicate variables and malformed lines produce warnings, and Pro reports redact environment values by default.

How .env is read

Each variable is compared by name, the way dotenv reads it.

Environment files drift. A variable is added to .env.local and never reaches .env.production, or a deploy fails because staging uses a different name. Diff Anything reads both files as a list of variables and reports three things: variables only on the left, variables only on the right, and variables whose value differs.

Names are compared exactly, including case, and listed alphabetically. An export prefix and spaces around = are allowed, and lines that start with # are comments. A value in matching single or double quotes is compared without the quotes and may continue over several lines up to the closing quote; in double quotes, escapes such as \n are read. In an unquoted value, a # after a space starts a comment, so PORT=80 # web port equals PORT=80, while COLOR=#fff keeps its value. References such as ${VAR} are compared exactly as written.

Files named .env, .env.local, .env.production, or anything ending in .env are detected automatically.

Masked values

See which values differ without showing them.

Every value is masked by default. A changed variable is reported as "API_KEY has a different value" and highlighted, but the value itself stays hidden. You can see that production and staging use different secrets without anyone reading them over your shoulder.

When you need to check a value, use Reveal value on that one cell. Reveal all asks for confirmation first. Revealed values are masked again as soon as either file changes.

In a Pro report export, Redact environment values is enabled by default, and turning it off asks "Include unredacted environment values in this report?" before anything is written.

Presence and warnings

Check only which variables exist, and catch broken lines.

Turn on Compare presence only when environments are expected to have different values. Only missing and extra variables are reported.

If a file sets the same variable twice, the last assignment is used and a warning names the duplicate. Lines that are not valid assignments, such as a line without = or a name that starts with a digit, are reported with their line number. When only one file has the duplicate or the broken line, the warning counts as a difference.

Copy variables

Copy a variable to the other file without revealing it.

Select a variable and use Right → left or Left → right. The assignment line is copied as written, including an export prefix and its quotes, and the value is not shown on screen. If the variable does not exist in the source, it is removed from the target.

Best for

Where this workflow fits.

• Comparing development, staging, and production variable sets
• Finding missing keys without pasting secrets into a browser
• Producing a redacted configuration report with Pro

No accounts, cloud comparison service, analytics, or telemetry.

Relevant capabilities

What Diff Anything brings to the job.

Practical workflow

From setup to a reviewed result.

1. Open two environment files

   Choose, for example, .env.example and .env.production. They open in Environment File mode.

2. Decide what counts

   Keep value comparison on, or turn on Compare presence only to look at variable names alone.

3. Fix missing variables

   Copy missing or outdated variables across with Right → left or Left → right, without revealing them.

4. Share a redacted result

   With Pro, export a report with Redact environment values left on.

Useful in practice

Direct answers

Questions about .env diff tool.

Go deeper

Choose sources, understand automatic detection, and select the engine that answers the question you are actually asking.

Related guides

Understand the workflow from another angle.