Env File Merger
Paste your .env cascade — .env, .env.local, .env.production, .env.production.local — lowest priority first, and get one resolved environment that says which file set every value and what it overrode. Export a merged .env, shell exports, JSON or a table. Runs entirely in your browser; nothing is uploaded.
About this tool
Paste up to four .env layers in priority order and get the resolved environment. The first layer is the lowest-priority base file, and each later layer overrides keys from the ones before it. Blank layers are skipped, so you can model the files you actually have.
The report output shows every winning KEY=value with a # set by ... provenance note, then lists the full override chain for keys that changed. Use the other output modes when you need a plain merged .env, shell export lines, JSON, a Markdown table, or only conflicting keys.
Worked example
Layer 1:
APP_NAME=demo
API_URL=https://dev.example.com
DEBUG=true
API_TOKEN=dev-token-123456
Layer 3:
API_URL=https://api.example.com
CDN_URL=https://cdn.example.com
Layer 4:
API_TOKEN=prod-token-987654
With output = report and secret masking enabled, the result includes:
API_URL=https://api.example.com # set by .env.production
API_TOKEN=pr****54 # set by .env.production.local
Override chain (2 keys)
API_URL
.env = https://dev.example.com
.env.production = https://api.example.com (wins)
Set mask_secrets = false when you want a copyable merged file. Set prefix_filter = VITE_ or NEXT_PUBLIC_ to see only variables exposed by a frontend framework.
Limits and edge cases
This tool parses pasted dotenv text; it does not read files from disk or mutate a running process environment. It handles comments, blank lines, export KEY=..., single and double quotes, inline comments, duplicate keys and ${VAR} references when expansion is enabled. Up to 20,000 distinct keys are kept.
FAQ
Which layer wins when the same key appears multiple times?
The highest-priority layer wins. Within a single layer, the later line wins for that layer and a warning is shown with the repeated line numbers.
Why are secret values masked?
mask_secrets is on by default so report, JSON, shell and Markdown outputs do not accidentally display values for keys containing words like SECRET, TOKEN, PASSWORD, KEY, AUTH or DSN. Turn it off when you need a usable merged file.
Does it expand ${VAR} references?
Only when expand_vars is enabled. References resolve against the merged result, so they see the final winning value from any layer. Single-quoted values stay literal, and unresolved or circular references become empty strings with warnings.
Can it discover .env files automatically?
No. Browser and CLI runs operate on pasted text fields. If you want to model shell or CI variables that outrank files, paste those variables into the highest-priority layer.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool env-file-merger "APP_NAME=demo
API_URL=https://dev.example.com
DEBUG=true
API_TOKEN=dev-token-123456"New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/env-file-merger/?layer1=APP_NAME%3Ddemo%0AAPI_URL%3Dhttps%3A%2F%2Fdev.example.com%0ADEBUG%3Dtrue%0AAPI_TOKEN%3Ddev-token-123456&layer2=DEBUG%3Dfalse&layer3=API_URL%3Dhttps%3A%2F%2Fapi.example.com%0ACDN_URL%3Dhttps%3A%2F%2Fcdn.example.com&layer4=API_TOKEN%3Dprod-token-987654&layer_names=.env%2C.env.local%2C.env.staging%2C.env.staging.local&output=report&mask_secrets=true&sort_keys=true&prefix_filter=VITE_&expand_vars=trueMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.