Env Variable Entropy Checker

Length is not strength. SECRET=aaaaaaaaaaaaaaaa is 16 characters and utterly predictable; SECRET=jK$9mQz2 is shorter and far stronger. The Env Variable Entropy Checker grades every value in your .env so weak secrets stop hiding in plain sight.

Each value gets an estimated bit count from its length and character diversity, then a series of penalty checks: repeated characters, sequential runs like 123456, placeholder words such as password or changeme, leading-zero patterns, and known-format guessability. All penalties are listed, so the report shows why something is weak, not just that it is.

The analysis is a heuristic and runs entirely in your browser.

• Entropy grade: low / medium / strong / superior.
• Bit estimate: length and diversity based.
• Penalty scan: repeats, sequences, placeholders.
• Per-value report: each secret graded separately.
• Weak-pattern flags: leading zeros, known words.
• Summary: weak count for the whole file.
• Copy or download: export findings.
• Private: nothing leaves the browser.

1. Paste your .env into the input, or load the sample with a mix of strong and weak values.
2. Click Check. Each secret-ish value is graded with reasons.
3. Review the weak ones and regenerate them with a generator.
4. Re-run until the file is clean.

Example 1 — The “random” session secret. SESSION_SECRET=admin is 5 characters of dictionary text; the checker grades it weak and names the reason.

Example 2 — Sequential trap. DATABASE_PASSWORD=1234567890 trips the run-detection penalty despite being ten characters.

Example 3 — Placeholder eve. API_KEY=changeme is caught by the known-placeholder scan before it ships to staging.

Example 4 — UUID-looking but short. A 36-char UUID-shaped value passes length checks; the checker still grades it fairly by diversity.

Example 5 — Audit gate. A team runs the checker in reviews and rejects any .env whose single weak flag is a real secret.

• Exposes fake strength: length without entropy.
• Explains itself: reasons for every deduction.
• Whole-file view: weak count at a glance.
• Complementary: pairs with the secret scanner.
• Private: fully client-side.
• Free: run as often as needed.