envkeydiff 0.1.0

Diff .env files by keys without leaking secrets

envdiff

Diff .env-style files by keys without leaking secrets by default.

Install

pip install envkeydiff

Then run the CLI as envdiff:

envdiff --help

Why

Comparing .env.example to local or production env files often dumps secrets into terminal scrollback and CI logs. envdiff compares key presence (and optional emptiness) while masking values unless you explicitly opt in.

Usage

# Default when both exist in the current directory
envdiff

# Explicit paths
envdiff .env.example .env

# Multiple files (each compared against the first / baseline)
envdiff --json .env.example .env .env.production

# Fail on empty values; ignore noisy keys
envdiff --strict --ignore SECRET_INTERNAL --ignore-prefix TEMP_

Output sections

Section	Meaning
missing_in_a	Keys present in B but not in A (baseline)
missing_in_b	Keys present in A but not in B
empty_values	Keys present in both where at least one side is empty
present_in_both	Shared keys (names only by default)

Flags

Flag	Description
--json	Machine-readable JSON
--show-values	DANGEROUS — print secret values
--strict	Treat empty values as failure (exit 1)
--ignore KEY	Ignore an exact key (repeatable)
--ignore-prefix PREFIX	Ignore keys with prefix (repeatable)
-V / --version	Print version

Exit codes

Code	Meaning
0	No key drift (and no empty values when --strict)
1	Missing keys, or empty values under --strict
2	Usage / file errors

Library API

from envdiff import parse_env_file, diff_env_files

entries = parse_env_file(".env")
result, _ = diff_env_files([".env.example", ".env"], ignore=["SECRET_INTERNAL"])
assert not result.has_drift(strict=True)

Development

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
pytest

License

MIT