Share a .env file without sharing secrets
The useful part of an .env file is its list of keys. The dangerous part is every value on the right of the equals sign. Split the two and you can ask for help without handing over the keys to production.
Keep the keys, replace the values
Redaction that keeps the debugging value
# before — never share this
DATABASE_URL=postgres://app:hunter2@db.prod.internal:5432/app
STRIPE_SECRET_KEY=sk_live_51H...
JWT_SECRET=8f3c...
# after — same shape, no credentials
DATABASE_URL=postgres://app:REDACTED@db.example.internal:5432/app
STRIPE_SECRET_KEY=sk_live_REDACTED
JWT_SECRET=REDACTEDKeep empty values as empty (SMTP_PASSWORD=) — a missing key and an empty key are different bugs. Keep quoting style and line order too, because loaders differ on both.
Audit the keys before you paste
Two commands that do not leak values
# print only the key names of an env file
cut -d= -f1 .env | sort
# see which keys look sensitive without printing values
grep -nE '^(.*)(KEY|TOKEN|SECRET|PASSWORD|PASS|DSN|CREDENTIAL)' .env | cut -d= -f1If the paste only needs to show which variables are set, send that list of names and skip the values entirely.
If a real value already escaped
Rotate it at the provider. A deleted paste is not a revoked credential: links get cached, forwarded, screenshotted and scraped. Rotate first, then tidy up. For a leaked DATABASE_URL, that means a password change and a check of connection logs; for an API key, revoke and reissue.
Frequently asked questions
Can I safely share a real .env file?
No. Replace every value. The key names and the shape of the connection string are what a helper needs.
Does the paste hide values automatically?
No. Redaction is manual and on you. The site stores exactly what you paste, and anyone with the link can read it.
What if I need to show a value because it is malformed?
Show the pattern with placeholders, or show only the part that is wrong (for example the port or the scheme). Never the credential itself.
Can I delete the paste afterwards?
Signed-in pastes can be deleted from the dashboard; anonymous ones cannot. Use expiry or burn-after-read if you are not signed in.