Compare two .env files without pasting secrets into a website

It works on my machine is, more often than anything else, a missing environment variable. The application starts, most of it behaves, and one feature fails in a way that looks like a bug in the code rather than an absence in the configuration. Comparing the two files takes a minute and is skipped because it feels beneath the problem.

The failure modes are specific and worth knowing. A key present in one environment and absent in the other is the obvious one. A key present in both but empty in one is worse, because the application starts happily and fails later at the point of use. A key defined twice, where the second definition silently wins, is worst of all, because the file appears to say something it does not do.

Which is why the comparison should be about keys rather than values. You almost never want to know that the production database password differs from the local one; you want to know that production has a key local does not. Anything that surfaces the shape of the difference without dwelling on the contents is doing the useful half of the job.

The reason to be firm about where this runs should be obvious and frequently is not. An environment file is the single most sensitive text file in most projects: API keys, database credentials, signing secrets, all in plain text with no protection but the file system. Pasting one into a web based diff tool sends every one of those to somebody else's server, and there is no way to take it back afterwards. A secret that has been transmitted is a secret that needs rotating, whatever the tool promised.

That is not a hypothetical concern in this organisation. A personal access token appeared in a chat transcript here and has been on the outstanding list ever since, and the lesson recorded at the time was the right one: a value that has been somewhere it should not be is exposed, regardless of where it was not written down.

This one runs entirely in the page. Nothing is transmitted, nothing is stored, and closing the tab is the whole of the cleanup. That constraint is the reason it is worth building rather than using one of the many that already exist.