Frequently Asked Questions

A .env file (pronounced "dot env") is a plain-text configuration file that stores key=value pairs of environment variables. For example: DATABASE_URL=postgres://... or API_KEY=sk-abc123. Applications read this file at startup to configure themselves without hardcoding secrets.

An .env file supplies environment-specific configuration variables to an application. This means you can use different values (e.g., development vs. production database URLs) simply by swapping the .env file, without changing any code. It separates configuration from code — a best practice known as the twelve-factor app methodology.

npm dotenv refers to the dotenv package on npm. It is one of the most downloaded npm packages of all time, with over 40 million weekly downloads. It reads a .env file in the current directory and sets the key=value pairs as environment variables accessible via process.env in Node.js.

In npm (Node Package Manager), dotenv is a lightweight zero-dependency package that auto-loads a .env file from your project root into process.env. Install it with npm install dotenv, then call require("dotenv").config() at the start of your app. It is available at npmjs.com/package/dotenv.

.env is a filename — a hidden file starting with a dot. Dotenv is the convention of storing environment variables in .env files, popularised by the dotenv npm package. The package reads the file and populates process.env in Node.js. Other languages have equivalent libraries: python-dotenv for Python, godotenv for Go, etc.

dotenv is no longer strictly required if you use Node.js 20.6+ (which supports node --env-file=.env app.js natively) or modern frameworks that handle env loading automatically (Next.js, Vite, Remix). However, for Node.js below 20.6, for explicit process.env access, or for portability across many tools, dotenv remains the de-facto standard.

No, dotenv is not part of the Python standard library. You need to install the python-dotenv package: pip install python-dotenv. Then import it with from dotenv import load_dotenv; load_dotenv(). Python 3.11+ added tomllib but no native .env file support.

Node.js (the runtime) is written in C++ and JavaScript. TypeScript is a typed superset of JavaScript that compiles to JavaScript. You can write your Node.js application in TypeScript — use ts-node, tsx, or compile with tsc first. dotenv works seamlessly with TypeScript: import dotenv from "dotenv"; dotenv.config();.

You can install dotenv with npm (npm install dotenv), yarn (yarn add dotenv), or pnpm (pnpm add dotenv). For Python, run pip install python-dotenv. After installation, call dotenv.config() (Node.js) or load_dotenv() (Python) before accessing environment variables.

Download Node.js from nodejs.org — npm is bundled automatically. Alternatively use a version manager: nvm (macOS/Linux) or nvm-windows for Windows. After installing Node.js, run node -v and npm -v to verify. Then install dotenv with npm install dotenv.

1. Install: npm install dotenv. 2. Create a .env file with PORT=3000 and API_KEY=abc123. 3. Load it at the top of your entry file: require("dotenv").config(); (CommonJS) or import "dotenv/config"; (ESM). 4. Access variables: process.env.PORT.

In Node.js (CommonJS): add require("dotenv").config() at the very top of your entry file before any other imports. In ESM projects, import with import "dotenv/config" as the first import. Alternatively (Node.js 20.6+) skip dotenv entirely and launch with node --env-file=.env server.js.

Install dotenv with npm i dotenv. In CommonJS: use require("dotenv").config() before accessing process.env. In ES Modules: use import "dotenv/config" as the first import. Your .env file in the project root should have one KEY=value pair per line.

Several ways to load a .env file in Node.js: (1) require("dotenv").config() with the dotenv package. (2) node --env-file=.env app.js (Node.js 20.6+ native). (3) import "dotenv/config" for ESM. (4) Some frameworks (Next.js, Vite, Remix) load .env automatically with no extra setup.

Install python-dotenv: pip install python-dotenv. Then at the top of your Python script: from dotenv import load_dotenv; import os; load_dotenv(); api_key = os.getenv("API_KEY"). If using Django, call load_dotenv() before django.setup(). The .env file format is the same: API_KEY=value.

Best practices for sharing .env with a team: (1) Use share-env for one-time, encrypted transfers — no accounts needed, burn-after-reading. (2) Use a secrets manager (Doppler, HashiCorp Vault, AWS Secrets Manager) for long-term team-wide secrets. (3) Never use version control, Slack, or email. (4) Commit a .env.example with placeholder values as a template.

Send a .env file securely using npx share-env push. This encrypts the file with AES-256-GCM before uploading to a relay server, then gives you a one-time share code. The recipient runs npx share-env pull <code>. The payload self-destructs after being pulled or after 10 minutes. The relay server never sees the decryption key.

To export/share your .env file to a teammate: use npx share-env push (encrypts and uploads), or export to shell variables with export $(cat .env | xargs) (Linux/macOS) for local use only. For CI/CD, configure secrets through your platform's secrets UI (GitHub Actions Secrets, Vercel Environment Variables) — never commit .env to git.

To import a received .env file using share-env: run npx share-env pull <share-code> — it decrypts and writes the file to your project root. To manually import in Node.js: call require("dotenv").config({ path: "./path/to/.env" }). In shell: use source .env or set -a; source .env; set +a.

.env files contain secrets — API keys, database passwords, OAuth tokens. Pushing them to git (especially public repos) permanently exposes those secrets. Even deleted secrets remain in git history and can be extracted. Secret scanners (GitHub, GitGuardian) will flag and may revoke exposed credentials automatically. Always add .env and .env.* to your .gitignore.

Yes. share-env encrypts your .env file using AES-256-GCM (the same cipher used by TLS 1.3). The encryption key is generated locally and never sent to the relay server — it only travels in the share code you control. Other options include git-secret, sops, or GPG encryption, but these require key management setup.

After loading dotenv (require("dotenv").config()), access variables via process.env.VARIABLE_NAME in Node.js, os.getenv("VARIABLE_NAME") in Python, or $_ENV["VARIABLE_NAME"] in PHP. On Linux/macOS you can also source the file: source .env to make variables available in the current shell session.

The .env file lives in the root directory of your project (same level as package.json, pyproject.toml, etc.). It is a hidden file (starts with a dot) — your file manager may not show it by default. Enable "show hidden files" in your OS or editor. In VS Code it always shows. On macOS: Cmd+Shift+. to toggle hidden files in Finder.

Configure your .env file by adding KEY=value pairs, one per line. Example: NODE_ENV=development, PORT=3000, DATABASE_URL=postgres://user:pass@localhost/db, API_KEY=your-key-here. Use a .env.example with placeholder values (committed to git) as a team template. Load with require("dotenv").config().

share-env uses AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode). This provides both confidentiality and integrity authentication — any tampering with the ciphertext is detected and rejected. The 256-bit key is generated locally and never transmitted to the relay server.

No. share-env requires zero accounts, zero configuration, and zero API keys. Simply run npx share-env push in any project with Node.js 18+ and a .gitignore that covers .env files. No login, no signup, no tracking.

No. share-env is burn-after-reading. The payload is permanently deleted from the relay server the moment it is pulled for the first time. If you try to pull the same share code twice, you will get a 404 error. This prevents accidental or malicious re-access.

By default, share-env payloads expire after 10 minutes (600 seconds). If no one pulls the payload within that time, it is automatically and permanently deleted from the relay server. This TTL significantly limits the attack surface.

Yes. The relay server is open source and can be self-hosted on any Node.js 18+ host (Render, Railway, Fly.io, VPS). Clone the GitHub repo, run npm install && npm start, then point your CLI at it with the --server flag.

Yes. share-env is 100% free and MIT licensed. The source code is publicly available on GitHub. The default relay server is provided free of charge with no usage limits (subject to rate limiting to prevent abuse).