# Env File Merger
Merge up to four layered .env files in your browser and see which file set each value, with the full override chain, secret masking and ${VAR} expansion.
## Run it
- **CLI:** `gizza tool env-file-merger "APP_NAME=demo
API_URL=https://dev.example.com
DEBUG=true
API_TOKEN=dev-token-123456"`
- **Web:** https://gizza.ai/tools/env-file-merger/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/env-file-merger/tool.json
## Inputs
- `layer1` — Layer 1 — base file, lowest priority (.env) _(field)_
- `layer2` — Layer 2 — overrides layer 1 (.env.local) _(field)_
- `layer3` — Layer 3 — overrides layers 1-2 (.env.production) _(field)_
- `layer4` — Layer 4 — highest priority (.env.production.local, or your shell vars) _(field)_
- `layer_names` — Layer names (comma-separated, optional) _(field)_
- `output` — Output _(field)_
- `mask_secrets` — Mask sensitive values (SECRET/TOKEN/PASSWORD/KEY/…) _(field)_
- `sort_keys` — Sort keys alphabetically _(field)_
- `prefix_filter` — Only keys starting with (optional) _(field)_
- `expand_vars` — Expand ${VAR} references against the merged result _(field)_
## Output
- Result (text)
## Query parameters
Open the tool pre-filled and auto-run via URL:
- `layer1` — Layer 1 — base file, lowest priority (.env)
- `layer2` — Layer 2 — overrides layer 1 (.env.local)
- `layer3` — Layer 3 — overrides layers 1-2 (.env.production)
- `layer4` — Layer 4 — highest priority (.env.production.local, or your shell vars)
- `layer_names` — Layer names (comma-separated, optional)
- `output` — Output
- `mask_secrets` — Mask sensitive values (SECRET/TOKEN/PASSWORD/KEY/…)
- `sort_keys` — Sort keys alphabetically
- `prefix_filter` — Only keys starting with (optional)
- `expand_vars` — Expand ${VAR} references against the merged result
Example: `https://gizza.ai/tools/env-file-merger/?layer1=APP_NAME%3Ddemo%0AAPI_URL%3Dhttps%3A%2F%2Fdev.example.com%0ADEBUG%3Dtrue%0AAPI_TOKEN%3Ddev-token-123456&layer2=DEBUG%3Dfalse&layer3=API_URL%3Dhttps%3A%2F%2Fapi.example.com%0ACDN_URL%3Dhttps%3A%2F%2Fcdn.example.com&layer4=API_TOKEN%3Dprod-token-987654&layer_names=.env%2C.env.local%2C.env.staging%2C.env.staging.local&output=report&mask_secrets=true&sort_keys=true&prefix_filter=VITE_&expand_vars=true`
---
## About this tool
Paste up to four `.env` layers in priority order and get the resolved environment. The first layer is the lowest-priority base file, and each later layer overrides keys from the ones before it. Blank layers are skipped, so you can model the files you actually have.
The report output shows every winning `KEY=value` with a `# set by ...` provenance note, then lists the full override chain for keys that changed. Use the other output modes when you need a plain merged `.env`, shell `export` lines, JSON, a Markdown table, or only conflicting keys.
### Worked example
Layer 1:
```dotenv
APP_NAME=demo
API_URL=https://dev.example.com
DEBUG=true
API_TOKEN=dev-token-123456
```
Layer 3:
```dotenv
API_URL=https://api.example.com
CDN_URL=https://cdn.example.com
```
Layer 4:
```dotenv
API_TOKEN=prod-token-987654
```
With `output = report` and secret masking enabled, the result includes:
```text
API_URL=https://api.example.com # set by .env.production
API_TOKEN=pr****54 # set by .env.production.local
Override chain (2 keys)
API_URL
.env = https://dev.example.com
.env.production = https://api.example.com (wins)
```
Set `mask_secrets = false` when you want a copyable merged file. Set `prefix_filter = VITE_` or `NEXT_PUBLIC_` to see only variables exposed by a frontend framework.
## Limits and edge cases
This tool parses pasted dotenv text; it does not read files from disk or mutate a running process environment. It handles comments, blank lines, `export KEY=...`, single and double quotes, inline comments, duplicate keys and `${VAR}` references when expansion is enabled. Up to 20,000 distinct keys are kept.
## FAQ
Which layer wins when the same key appears multiple times?
The highest-priority layer wins. Within a single layer, the later line wins for that layer and a warning is shown with the repeated line numbers.
Why are secret values masked?
`mask_secrets` is on by default so report, JSON, shell and Markdown outputs do not accidentally display values for keys containing words like `SECRET`, `TOKEN`, `PASSWORD`, `KEY`, `AUTH` or `DSN`. Turn it off when you need a usable merged file.
Does it expand ${VAR} references?
Only when `expand_vars` is enabled. References resolve against the merged result, so they see the final winning value from any layer. Single-quoted values stay literal, and unresolved or circular references become empty strings with warnings.
Can it discover .env files automatically?
No. Browser and CLI runs operate on pasted text fields. If you want to model shell or CI variables that outrank files, paste those variables into the highest-priority layer.
## Related tools
- [Dotenv Manager](https://gizza.ai/tools/dotenv-manager/): Parse, validate, merge and secret-mask .env files in your browser: flag duplicate and missing keys, lint names, and export .env.example or JSON. No upload.
- [Article to EPUB](https://gizza.ai/tools/article-to-epub/): Turn article text or cleaned HTML into a valid EPUB 3 ebook with metadata, chapter splits, and a real table of contents. Runs in your browser.
- [Preview a Bulk File Rename](https://gizza.ai/tools/bulk-file-renamer/): Preview old-to-new filename mappings with find/replace, regex, numbering, case conversion, prefix/suffix, and collision warnings.
- [Citation Generator](https://gizza.ai/tools/citation-generator/): Free APA 7, MLA 9, Chicago and Harvard citation generator — format author, title, year, journal and URL into a correct reference right in your browser.
- [Config Merge Tool](https://gizza.ai/tools/config-merge/): Merge layered JSON, YAML, TOML and .env configuration files with override precedence, array strategy, null deletion and variable substitution.