What is a .env file, and how do you keep secrets out of git?

A .env file keeps settings and secrets out of your code. It only protects you if it never reaches git, and the syntax has a few traps.

What it looks like

# Database
DATABASE_URL=postgres://app:s3cret@localhost:5432/app
PORT=3000
DEBUG=false
GREETING="Hello, world"   # quotes keep the comma and space
PRIVATE_KEY="-----BEGIN KEY-----\nMIIB...\n-----END KEY-----"

Your code then reads process.env.PORT, os.environ["PORT"] and so on. The point is that the same code runs on your laptop, a test server and production, each with its own values, and no password sits in the source.

Syntax rules that trip people up

There is no single official standard, so the exact rules depend on the loader. Keep values simple and quote anything unusual.

Keeping it out of git

# .gitignore
.env
.env.*
!.env.example

Then commit a .env.example listing every variable with a blank or fake value, so the next person knows what to fill in. Add the ignore line before the first commit: once a file is tracked, .gitignore no longer affects it. To stop tracking one that slipped in, run git rm --cached .env and commit, then treat everything in it as leaked.

Loading it

• Node.js 20.6+: node --env-file=.env app.js, no package needed. Older versions: the dotenv package.
• Python: python-dotenv, then load_dotenv() at start-up.
• Docker Compose: reads .env next to compose.yaml for ${VAR} substitution; pass values into containers with env_file:. Never COPY .env into an image: anyone who pulls the image gets it. Add .env to .dockerignore too.
• Front-end bundlers (Vite, Next.js, Create React App): variables with a public prefix such as VITE_ or NEXT_PUBLIC_ are pasted into the JavaScript every visitor downloads. Never put a secret key behind those prefixes.

If you already pushed a secret

1. Rotate it first. Create a new key or password and revoke the old one. Bots scan public repositories for keys within minutes, so assume it has been seen.
2. Remove the file from the repo and add it to .gitignore.
3. Optionally rewrite history with git filter-repo or BFG, and force-push. That tidies up, but forks, clones and caches may still hold the old commit, which is why step 1 comes first.

Note that Base64 is not encryption: a Base64-encoded secret in a file is still a plain secret.

Making good secrets

For session secrets, API tokens and database passwords, use long random values rather than words: 32 or more random characters, or 32 random bytes as hex. The password generator makes them in your browser with the system's secure random generator, and nothing is sent anywhere. Want to share one with a teammate without leaving it in a chat log? A one-time link from Fusenote burns itself after reading.

Secrets in the browser are a different problem: localStorage vs cookies.

Questions

Published 4 November 2026.