.env

Format

.env files use a simple format – keys and values separated by an equal sign. Here's a complete example covering the common cases:

# .env — keep secrets out of code
# Lines starting with # are comments

# Keys: letters, digits, underscore (must not start with a digit)
DATABASE_URL=postgres://localhost/my_database
API_KEY="quoted value"           # inline comment after the value
LITERAL='no ${interpolation}'    # single quotes stay literal

# Interpolation (unquoted and double-quoted values)
HOST=localhost
URL=https://${HOST}/api

# Invalid keys — do not use:
# NO-WORK=
# 2MUCH=
# ÜBER=

Load values in your app with process.env (or your language’s equivalent).

console.log('Hello ' + process.env.HELLO)

import os
print("Hello " + os.getenv("HELLO", ""))

It's a convenient and widely adopted format for separating your secrets and config from your code.

Keys

For the sake of portability (and sanity), environment variable names (keys) must consist solely of letters, digits, and the underscore (_) and must not begin with a digit. In regex-speak, the names must match the following pattern:

[a-zA-Z_]+[a-zA-Z0-9_]*

Example keys:

DATABASE_URL  # ok
foobar        # ok (but not recommended. use upcase)
NO-WORK       # <-- invalid !!!
ÜBER          # <-- invalid !!!
2MUCH         # <-- invalid !!!

Values

Values are to the right of the equals sign. They may be quoted. Using single quotes will prevent variables from being interpolated.

SIMPLE=xyz123
INTERPOLATED="Multiple\nLines"
NON_INTERPOLATED='raw text without variable interpolation'
MULTILINE = `long text here,
e.g. a private SSH key`

Syntax

Cheat sheet — what you write, and what you get:

Comments

The hash-tag # symbol denotes a comment when on its own line or when it follows a quoted value. It is not treated as a comment when it appears within quotes.

# This is a comment
SECRET_KEY=YOURSECRETKEYGOESHERE # also a comment
SECRET_HASH="something-with-a-hash-#-this-is-not-a-comment"

Interpolation

Interpolation (also known as variable expansion) is supported in environment files. Interpolation is applied for unquoted and double-quoted values. Both braced (${VAR}) and unbraced ($VAR) expressions are supported.

• Direct interpolation: ${VAR} → value of VAR
• Default value: ${VAR:-default} → value of VAR if set and non-empty, otherwise default
• Alternative value: ${VAR:+alternate} → value of alternate if VAR is set and non-empty, otherwise empty

Command Substitution

Add the output of a command to one of your variables in your .env file. Command substitution is applied for unquoted and double-quoted values.

DATABASE_URL="postgres://$(whoami)@localhost/my_database"

Encryption

More recently, dotenvx pioneered encryption support for .env files. Built by the same creator as dotenv, it extends the familiar format with ciphertext values and asymmetric key pairs: a public key encrypts values, and a separate private key decrypts them.

Learn more about the encrypted .env format →

History

The .env file format was introduced by Heroku in 2012 and popularized by the dotenv node and dotenv ruby libraries in 2013. Encryption support landed in May 2024.

A litmus test for whether an app has all config correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials. — The Twelve-Factor App