Move between an environment file and JSON. Comments, quoting and duplicate keys are handled.
A line whose first non blank character is a number sign is skipped as a comment. In an unquoted value, everything from a number sign onward is also cut off as an inline comment. A number sign inside a quoted value stays part of the value. A leading export is treated as a prefix and is not part of the key name.
A double quoted value has backslash escapes expanded: line feed, tab, carriage return, the backslash itself and the double quote. A single quoted value is taken literally with no escape processing. An unquoted value has leading and trailing whitespace removed.
An environment variable value is always a string, so every value in the JSON output is a string too. Values that look numeric are not turned into numbers. In the other direction, numbers, booleans and null in the JSON are written out as strings. Objects and arrays are serialized back to a single line of JSON and the value is quoted.
This tool makes no network requests and converts entirely inside the browser. Even so, a .env file often holds production credentials, so the safer habit is not to paste it anywhere it is not needed. If the goal is sharing, convert a template with the values blanked out instead.
Whenever the value contains whitespace, a quote character, a line break or a number sign. Without quotes, everything after a space can be treated as something else and everything after a number sign is dropped as an inline comment. When converting JSON to .env this tool quotes exactly those values with double quotes and escapes the quotes and backslashes inside.
The tool keeps the value written later and lists the duplicated key as a warning. A JSON object cannot hold duplicate keys, so the duplication cannot be carried over. Rather than dropping it silently, the tool shows it so you can check which one you meant.
No. Parsing and conversion run entirely in JavaScript inside your browser, and what you type is never transmitted to or stored on a server. Even so, it is safer not to paste production credentials anywhere they are not needed.