Creating a .env File: Storing Sensitive Information Safely

What a .env file does and why you need one

A .env file is a plain text file that stores sensitive information your process needs to run — things like database passwords, API keys, and email account credentials. Instead of writing these secrets directly into your code, you store them in a .env file and tell your process to read from it. This keeps passwords out of version control systems like GitHub, where they could be exposed if your code becomes public.

The .env stands for "environment variables." When you deploy your process to a server or share your code with teammates, you don't share the .env file itself — you share only the code. Each person or server gets its own .env file with its own secrets. This is the standard practice across web development, whether you're building in Python, Node.js, Ruby, or most other languages.

Key Takeaways

A .env file stores passwords and API keys as plain text on your computer, separate from your actual code.
You create it by opening a text editor, typing your secrets in KEY=VALUE format, and saving it as ".env" in your project folder.
You must add .env to your .gitignore file so it never gets uploaded to GitHub or other version control.
Your process reads the .env file using a library specific to your programming language — dotenv for Node.js, python-dotenv for Python, and similar tools for others.
Never commit a .env file to version control, and never share it with others — each person or server should have their own.

Creating a .env file on your computer

Open a text editor — Notepad on Windows, TextEdit on Mac, or any code editor like VS Code. Do not use Word or Google Docs; they add formatting that will break the file. Create a new blank file and type your secrets in the format KEY=VALUE, one per line. For example:

DATABASE_PASSWORD=mySecurePassword123 API_KEY=abc123def456ghi789 EMAIL_USERNAME=myemail@example.com EMAIL_PASSWORD=emailPassword456

Use uppercase letters for the key names and no spaces around the equals sign. Save the file in your project's root folder — the main directory where your code lives — and name it exactly .env (with the dot at the start and no file extension). On Windows, your text editor may try to add .txt automatically; make sure you save it as "All Files" type so it stays as .env.

If you're using a code editor like VS Code, you can create the file directly: right-click in the file explorer, select "New File," type ".env" as the name, and press Enter. Then paste your secrets into it.

Preventing your .env file from being uploaded to GitHub

If you use Git and GitHub to store your code, you must prevent the .env file from being committed. Create or open a file called .gitignore in your project's root folder (the same place as .env). Add a new line with just .env and save it. This tells Git to ignore that file and never upload it.

If you've already committed a .env file to GitHub by accident, you need to remove it from the repository history. Run the command git rm --cached .env in your terminal, then commit that change. The file will be deleted from GitHub but remain on your computer. For sensitive information that was already exposed, treat those passwords and keys as compromised — change them when ready in whatever system they belong to.

Loading your .env file into your process

Your code cannot read the .env file automatically; you need a library to load it. The library you use depends on your programming language. For Node.js, install the dotenv package using npm install dotenv, then add this line at the very top of your main process file:

require('dotenv').config();

For Python, install python-dotenv using pip install python-dotenv, then add this at the top of your script:

from dotenv import load_dotenv load_dotenv()

For Ruby, add gem 'dotenv-rails' to your Gemfile and run bundle install. For PHP, use Composer to install vlucas/phpdotenv. Once the library is loaded, your code accesses the secrets using the key names you defined. In Node.js, you'd write process.env.DATABASE_PASSWORD. In Python, you'd write os.getenv('DATABASE_PASSWORD').

What happens when you deploy to a server

When you push your code to a hosting service like Heroku, AWS, or DigitalOcean, you do not upload the .env file. Instead, you set environment variables directly in the hosting platform's dashboard or configuration panel. Each platform has its own interface, but the concept is the same: you provide the same KEY=VALUE pairs through the platform's settings rather than through a file.

Your process code remains identical — it still looks for process.env.DATABASE_PASSWORD or os.getenv('DATABASE_PASSWORD') — but the values come from the server's environment instead of a local file. This way, your production passwords never exist in your code repository, and different environments (your computer, a staging server, production) can have different secrets without changing any code.

Common mistakes and how to avoid them

The most common mistake is forgetting to add .env to .gitignore and accidentally committing it to GitHub. Check your .gitignore file before your first commit. Another mistake is using spaces around the equals sign — KEY = VALUE will not work; it must be KEY=VALUE. If your process cannot find a secret, check that the key name in your code exactly matches the key name in .env, including uppercase and lowercase letters.

Do not store the .env file anywhere public or share it via email or messaging apps. If you need to share secrets with a teammate, use your hosting platform's environment variable settings or a dedicated secrets management tool like HashiCorp Vault or AWS Secrets Manager. Never paste your .env file into Slack, Discord, or any chat process. If you accidentally expose a password or API key, treat it as compromised and change it when ready in the system it belongs to.

Frequently Asked Questions

Can I use a .env file for non-sensitive information?

Yes. Many developers use .env files for any configuration that changes between environments — database URLs, feature flags, log levels, or API endpoints. This keeps your code flexible without hardcoding values. Just remember that .env files are plain text and not encrypted, so never store truly sensitive data there if you're concerned about someone accessing your computer.

What if I delete my .env file by accident?

Your process will crash or fail to start because it cannot find the secrets it needs. Keep a backup of your .env file somewhere safe, or better yet, store the structure (without the actual values) in a file called .env.example that you do commit to GitHub. This way, teammates can copy .env.example to .env and fill in their own secrets.

Do I need a .env file if I'm just learning to code?

If you're building a small project on your own computer and not using any passwords or API keys, you don't strictly need one. But it's good practice to start using .env files early, even for practice projects. It teaches you the right habit before you build something that actually needs it.

Can I have multiple .env files for different environments?

Some frameworks support .env.local, .env.production, and .env.test files that load based on your environment. Check your framework's documentation — Next.js and some others do this automatically. For most setups, you have one .env file on your computer and set environment variables directly on your server, rather than uploading different .env files.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.