~
envdiff comparing .env.dev with .env.prod, one line per key marking API_KEY as removed, five values as changed and SENTRY_DSN as added; the same diff re-run with --mask redacts API_KEY, DATABASE_URL and STRIPE_SECRET_KEY while leaving LOG_LEVEL and PORT readable.
back to projects

oss project

Project status: stable

envdiff

Compare, validate, and sync .env files across environments.

install 

$ brew install shahadulhaider/tap/envdiff
Go
github.com/shahadulhaider/envdiff
Homebrew
shahadulhaider/tap/envdiff
Source
fig. 02
envdiff check run against an .env missing API_KEY prints "API_KEY is missing from .env", reports one missing and zero extra, and exits 1; after the key is appended the same command prints nothing and succeeds.
Non-zero exit on drift — drop it straight into CI or a pre-commit hook.
fig. 03
envdiff compare rendering .env.dev, .env.staging and .env.prod as three columns of one matrix, showing API_KEY missing from staging and prod, SENTRY_DSN missing from dev and staging, and LOG_LEVEL differing across all three.
N files side by side; missing keys are obvious at a glance.
fig. 04
envdiff sync applying changes from .env.dev onto .env.prod through an interactive list of five ticked changes; DATABASE_URL is unticked with the space bar and skipped, and the remaining four are applied, leaving comments and the skipped key untouched.
The sync picker — four keys ticked to carry over, DATABASE_URL left behind.

Why it exists

Every team I have worked with has lost time to “it works on my machine because I have a secret you don’t.” envdiff makes the comparison explicit:

envdiff diff .env .env.staging .env.production
envdiff validate --schema env.schema.toml .env
envdiff sync .env .env.staging

Useful primitives:

  • Schema-validated env files — define required keys, types, and patterns in TOML; fail-fast in CI.
  • Matrix view — render N env files side-by-side; spot missing keys instantly.
  • Pre-commit integration — fail commits that diverge a .env.example from .env.
  • GitHub Actions annotations — drift shows up in the PR diff UI.
  • Secret masking — values redacted in output unless --show-values.
  • Interactive sync TUI — Bubble Tea-driven merge resolver.
brew install shahadulhaider/tap/envdiff