Next.js .env Example and Validator
Next.js projects usually mix server-only secrets with NEXT_PUBLIC values. This page gives you a focused checklist before you paste your file into the validator.
Use Cases
- Review .env.local before deployment
- Separate server secrets from public browser variables
- Create a safer .env.example for teammates
Workflow
- 1Paste your .env.local content into the validator.
- 2Check duplicate keys, weak secrets, empty values, and malformed lines.
- 3Export a cleaned .env.example after removing private values.
Practical Tips
- Only expose values with NEXT_PUBLIC_ when the browser truly needs them.
- Keep deployment secrets in your hosting provider, not in git.
- Document required variables with clear placeholder names.
Common Questions
Can I paste real secrets into the validator?
The tool runs in your browser and stores data locally, but you should still remove unnecessary secrets before sharing screenshots or reports.
Should NEXT_PUBLIC variables be treated as secrets?
No. Anything prefixed with NEXT_PUBLIC can be exposed to users in the browser bundle.