Darnly.env.example generator: is your .env safe?
Paste your .env to get a clean .env.example you can commit, with a note for every key. It also catches secrets your framework would ship to every visitor’s browser.
Free from Darnly. Spot a bug in the app you're building? Darnly hands it to Claude Code, Codex or Cursor in one key.Add to Chrome
🔒 Runs only in your browser. Your .env is never uploaded or saved, not even by us.
Reading the example…
Try an example:
See every key explained
| Key | What it is | Where | Why |
|---|
What to do next
- Save the file as
.env.examplein your project’s top folder, next topackage.json, and commit it. - Make sure
.envis in.gitignoreso the real one is never committed. The .gitignore generator adds it for you. - Put the real values in your host’s settings too (Vercel, Netlify or Cloudflare: Environment Variables).
- Already live? Run the API key leak checker on your site to see whether a secret is already in its public JavaScript.
More free tools
See all 89 tools- API key leak checkerDid I leak an API key? Check your site’s JavaScript for OpenAI, Stripe, Supabase and other secret keys.
- JWT decoderPaste a token and see when it expires, who it’s for and its role, in plain words. Nothing is uploaded.
- EXIF removerSee if your photos show where you live, then remove the location, date and camera info in one click.
How it works
- Paste your
.envfile into the box, or try one of the examples. It never leaves your browser: there is no upload, and nothing is saved. - The card at the top tells you straight away if a secret would be shipped to the browser. Frameworks put every key that starts with
NEXT_PUBLIC_,VITE_,PUBLIC_orREACT_APP_into the JavaScript your visitors download. - Copy or download your
.env.exampleand commit it. Every value is removed and each key gets a short note saying what it is and whether it’s server only. If something leaked, press Copy prompt and paste it into your AI agent to move the secret to server code.
Questions
Is it safe to paste my real .env here?
Yes. Everything happens in this browser tab with JavaScript on the page. Your file is never sent to Darnly or anyone else, and it isn’t saved, so closing the tab forgets it. You can even turn off your internet after the page loads and it still works.
What is a .env.example file?
It’s a copy of your .env with the values taken out. You commit it to Git so you, your teammates and your AI agent know which settings the app needs, without sharing the real keys. The real .env stays on your computer and in your host’s settings, and is listed in .gitignore.
Why is NEXT_PUBLIC_ or VITE_ dangerous for secrets?
Those prefixes tell the framework “this value is fine for the browser”, so it copies the value into your site’s JavaScript. Anyone can open DevTools and read it. That is right for a Supabase anon key or a Stripe publishable key, and wrong for a Stripe secret key, an OpenAI key or a database password, which must only be used in server code.
A secret already went live with a public prefix. What now?
Treat it as stolen. Create a new key in the provider’s dashboard and delete the old one, then rename the variable without the prefix and move the code that uses it to an API route or server function. The prompt button writes those instructions for your AI agent.
How does it know which keys are secret?
It looks at the name (words like SECRET, TOKEN, PASSWORD, API_KEY), at known services like Supabase, Stripe, Clerk, Firebase, OpenAI and Anthropic, and at the shape of the value, such as sk_live_, sk-ant-, ghp_, private keys and database URLs with a password. It even reads Supabase keys to tell the anon key from the service role key. When it can’t tell, it says so.
Does it keep any values?
Only harmless ones if you leave “Keep harmless values” on: plain settings like PORT=3000, NODE_ENV=development or a localhost URL. Everything else is emptied, including old keys you commented out.