PASSWORD="s3cret" Is Not the Same Password in Every Parser

How to Use This Tool

Paste a .env file and pick an output format. The conversion is the easy part; the list of parser-dependent lines underneath is the reason to use this rather than a regular expression.

There is no .env specification

The format grew out of shell scripts and a Ruby library, and every reimplementation since has made its own decisions about the edge cases. Node's dotenv, python-dotenv, Docker Compose, Vite, Next.js and the shell all differ somewhere. That is fine until a value travels between two of them.

Quotes are the expensive one

Most dotenv libraries treat surrounding quotes as delimiters and strip them, so DB_PASSWORD="s3cret" gives you s3cret.

Docker Compose's env_file historically did not: it read the whole thing after the equals sign, quotes included, so the same line gave you "s3cret" — eight characters instead of six. The failure mode is a service that cannot authenticate, no error mentioning quotes, and a value that looks correct in every log because the quotes read as formatting.

The safe habit is to quote only when the value actually needs it — leading or trailing spaces, a #, or a newline — and to leave everything else bare.

The hash character

Most parsers start a comment at an unquoted # that follows whitespace, so PORT=3000 # the app port gives 3000. Some start one at any unquoted #, which quietly truncates:

• BRAND_COLOUR=#ff6600 becomes an empty string.
• PASSWORD=ab#cd becomes ab.

Generated passwords contain hashes often enough that this is a real source of intermittent authentication failures. Quote any value containing one, and accept the quoting risk above as the smaller of the two problems.

The rest of the rules, as most parsers implement them

• Only the first equals splits. URL=postgres://u:p@h/db?a=1 is one value. The connection strings that make people nervous are actually fine.
• An empty value is an empty string, not unset. EMPTY= sets the variable; your if not set check will not fire.
• Everything is a string. DEBUG=false is the five-character string "false", which is truthy in most languages. This is the single most common .env bug.
• Trailing whitespace is stripped by some parsers and kept by others. Invisible, and it breaks equality comparisons.
• Duplicate keys usually resolve to the last one, silently.
• Variable names should match [A-Za-z_][A-Za-z0-9_]*. Hyphens and dots work in some loaders and not in a shell.
• export prefixes are accepted by most parsers and required by none.

Type inference is a convenience, not a rule

The inference option here turns 3000 into a number and true into a boolean in the JSON and YAML output, because that is usually what you want when moving config into a structured format. Be aware it is a decision this tool is making, not something the .env file said. Environment variables are strings all the way down, and version numbers like 1.10 become 1.1 if something helpfully parses them as numbers.