🔑 Env Variable Manager

🎯 Preset

Load a starter template for a common deployment stack. Replaces the current row state.

📥 Input mode

📋 Paste .env file

Lines starting with # are comments. KEY=value with optional double / single quotes. export prefix is tolerated.

📝 Variables

{{ rowCount }} variable(s)

Toggle the lock icon to mark a value as a secret. Secret rows are split off into the Kubernetes Secret when that output format is selected; everything else stays in the ConfigMap.

KEY value 🔒

🛠️ Output format

☸️ Kubernetes metadata

📤 Output

{{ outputFilename }} · {{ output.length }} bytes

⚠️ Format warnings

{{ w }}

🔍 Audit findings

{{ highCount }} high · {{ mediumCount }} medium · {{ findings.length }} total
No issues detected. Add values to scan for credentials, weak passwords, and duplicates.
{{ f.severity }} {{ f.key }}
{{ f.issue }}
{{ f.suggestion }}
⚠️

ℹ️ About Env Variable Manager

What this tool does

The Env Variable Manager parses, validates, normalizes, audits, and converts .env-style configuration between the formats real-world deployment stacks expect. Paste an existing .env file (or add KEY/value rows by hand), then export to a .env, a shell export script, a Docker Compose environment: block (map or list form), a Kubernetes ConfigMap + Secret pair, a GitHub Actions env: block, or canonical JSON / YAML.

The audit pass scans every value for high-confidence credential leak patterns (AWS, GitHub PATs, OpenAI, Anthropic, Stripe, Slack, Google API keys, PEM private keys, JWTs), weak placeholder passwords (admin, changeme, password), duplicate keys, invalid KEY syntax, and common boolean / environment typos. Every operation runs entirely in your browser; nothing leaves the page unless you call the API endpoint deliberately.

What a .env file is (12-factor app §III)

  • Plain text file, one KEY=value per line, sitting next to the application source — but never committed when it contains credentials.
  • The 12-factor app manifesto §III pins this as the canonical way to keep environment-dependent configuration (database URLs, API keys, hostnames, log levels) out of the codebase.
  • Loaders — Node uses dotenv (motdotla); Python uses python-dotenv or django-environ; Ruby uses dotenv-rails; Docker reads --env-file; Compose merges .env into the variable interpolation scope; Kubernetes ships values via ConfigMap / Secret mounts or envFrom:.
  • Key syntax — keys match /^[A-Za-z_][A-Za-z0-9_]*$/. POSIX names (uppercase + underscore) are the de-facto convention.
  • Value syntax — bare values are trimmed; double-quoted values support \n, \r, \t, \\, \"; single-quoted values are literal. Inline #comment after a bare value is stripped.

Format conversions this tool emits

  • .env — canonical KEY=value lines with quoting added where needed.
  • Shell export — export KEY='value', safe for bash/zsh source ./env.sh. Single-quoting protects every character.
  • Docker Compose environment: (map form) — YAML map under a Compose service block. See docs.docker.com/compose/environment-variables.
  • Docker Compose environment: (list form) — - KEY=value array form, useful when interpolation order matters.
  • Kubernetes ConfigMap — non-secret variables only. Spec: kubernetes.io/docs/concepts/configuration/configmap.
  • Kubernetes Secret — secret values, base64-encoded under data:, type: Opaque. Mount via envFrom: { secretRef: ... }. Spec: kubernetes.io/docs/concepts/configuration/secret.
  • GitHub Actions env: — job or step level env block. The preset shows the ${{ secrets.NAME }} reference syntax so you never paste raw tokens into your workflow file.
  • JSON / YAML — flat {"KEY": "value"} for tools that bootstrap from a structured config file.

Secret detection patterns

The audit pass uses pattern-matching to spot high-confidence credential leaks. Recognised shapes include:

  • AWS Access Key ID — AKIA… / ASIA… / AROA… / AIDA… + 16 base32 chars.
  • GitHub PAT — ghp_, gho_, ghu_, ghs_, ghr_, or fine-grained github_pat_*.
  • OpenAI API key — sk- / sk-proj- + 32+ chars.
  • Anthropic API key — sk-ant- + 20+ chars.
  • Stripe secret key — sk_live_ / sk_test_ + 24+ chars.
  • Slack token — xoxb- / xoxp- / xoxa-.
  • Google API key — AIza + 35 chars.
  • PEM private key — -----BEGIN ... PRIVATE KEY-----.
  • JWT (likely) — three dot-separated base64url segments starting with eyJ.
  • High-entropy string — ≥ 32-char base64-shaped value with Shannon entropy > 4.0 bits/char.
  • Weak password placeholders — admin, password, changeme, secret, letmein, etc.
  • Duplicate keys — later definition overrides earlier per dotenv semantics.

Hardening checklist

  • Don't commit .env to git. Add it to .gitignore and ship a redacted .env.example instead.
  • Rotate any value the audit flags as a real credential. Pattern matches mean the value matches a published shape — treat it as exposed.
  • Use a secret manager in production. AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager, Azure Key Vault, Kubernetes Secrets / Sealed Secrets, Doppler.
  • For Kubernetes, ConfigMap is plain text. Anything sensitive goes in a Secret (this tool splits them automatically via the per-row Secret toggle).
  • For Docker Compose, environment: is visible to anyone who can docker inspect the container. Mount as files via secrets: in production.
  • For GitHub Actions, never paste raw tokens. Use repo / org secrets and reference via ${{ secrets.NAME }} in your workflow file.

API Usage Example:

POST /api/tools/linux/env-variable-manager
Content-Type: application/json

{
    "operation": "format",
    "input": {
        "variables": [
            {
                "key": "NODE_ENV",
                "value": "production"
            },
            {
                "key": "DATABASE_URL",
                "value": "postgres://app:pw@db:5432/app",
                "secret": true
            }
        ],
        "format": "k8s-secret",
        "name": "app-secrets",
        "namespace": "default"
    }
}
Ready