Turn a .env into a safe .env.example and list the secrets it found by kind and line without echoing them.

Env scrubberFreeFor developers

5 min

saved on a typical run. Our estimate, against blanking each value of a typical 10 to 20 line .env by hand and checking for secrets you missed.

Before: what you give it

The example input, as typed in. You paste text or a file's contents.

NODE_ENV=production
PORT=3000
DEBUG=true
DATABASE_URL=postgres://app:fakepassword123@db.internal:5432/app
STRIPE_SECRET_KEY=sk_live_FAKEfakeFAKEfakeFAKEfake00
export API_URL=https://api.example.com/v1
openai_key=sk-FAKEfakeFAKEfakeFAKEfakeFAKEfake99
PORT=8080

After: what comes back

The first lines of a real run of the tool's own code on that input. Nothing here is edited by hand.

NODE_ENV=
PORT=3000
DEBUG=true
DATABASE_URL=postgres://USER:PASSWORD@HOST:5432/DB
STRIPE_SECRET_KEY=
export API_URL=https://HOST/PATH
openai_key=
PORT=8080

8 variables, 3 secrets
  SECRET  line 4  DATABASE_URL  [database-url-password]  starts with "post", 51 chars. Rotate the database password if this file was ever committed or shared.
  SECRET  line 5  STRIPE_SECRET_KEY  [stripe-live-key]  starts with "sk_l", 34 chars. Rotate it if this file was ever committed or shared.
  SECRET  line 7  openai_key  [openai-key]  starts with "sk-F", 37 chars. Rotate it if this file was ever committed or shared.
  LOW    line 6: API_URL uses an `export` prefix. Plain dotenv parsers and Docker --env-file read it differently; drop `export` unless a shell sources this file.
  LOW    line 7: openai_key is not UPPER_SNAKE_CASE. Rename it so it matches the convention shell, Docker and CI tools expect.
  MEDIUM line 8: PORT is already set on line 2. Loaders disagree on which one wins; keep one.

What you get

A committable .env.example keeping each value's shape, a secrets list with line numbers, and duplicate or quoting findings

What it cannot do

Recognises secrets by key name and known formats; an unusual secret in a plain-looking variable can slip through. Check the result before you commit it.

Who it is for

Developers

Free and Pro

Free	30 runs a day per IP address, up to 20,000 characters a run.
Pro	No daily limit, 300 requests a minute, up to 200,000 characters a run.

Daily caps for every tool

Use it from your assistant

The tool is called scrub_env. Connect the server once, then ask for it by name or describe the job. Install steps.

claude mcp add --transport http toolbox https://toolbox.allthepossibles.com/mcp

curl -X POST https://toolbox.allthepossibles.com/api/env-example -H 'content-type: application/json' -d '{"text":"NODE_ENV=production\nPORT=3000\nDEBUG=true\nDATABASE_URL=postgres://app:fakepassword123@db.internal:5432/app\nSTRIPE_SECRET_KEY=sk_live_FAKEfakeFAKEfakeFAKEfake00\nexport API_URL=https://api.example.com/v1\nopenai_key=sk-FAKEfakeFAKEfakeFAKEfakeFAKEfake99\nPORT=8080"}'

Try it here

The form starts with the same example input, so you can run it first and then swap in your own.

.env file contents