How to use
- main.tf
Paste .tf (several files)
- Blocks and findingswith line numbers
Structure and findings
- main.tf (formatted)indent and = aligned
Format and save
Paste a .tf, or drop files (several allowed; “Choose file” works too). “Try a sample” shows how it works.
Open “Structure” for the block list, variables (type, default, sensitive), module source and version, and provider versions.
Open “Findings” for a list ordered by severity, with file names and line numbers. Secret-looking values themselves are not shown. If variables live in another file, add that file too.
Use “Format” to copy or save the .tf with aligned indentation and =. Nothing is formatted when there is a syntax error.
What it does
Its own HCL parser
Reads ${ } interpolation in strings, <<EOT and <<-EOT heredocs, #, // and /* */ comments, lists and objects. Anything it cannot parse is reported with a line number.
Only findings with a basis
Checks strings written into secret-like attributes, secret-like variables without sensitive, unpinned versions, 0.0.0.0/0 access to ports 22 and 3389 in aws_security_group and similar, public-read style S3 ACLs, undefined references and duplicates.
Secret values stay off the screen
Findings show attribute names only, never a value written in the file, and the variable table hides defaults of secret-like variables. The Format output tidies the .tf as it is, so it does contain the values.
Formatting close to terraform fmt
Uses a 2-space indent and aligns = across consecutive one-line attributes. Heredoc bodies are left alone. It is not identical to terraform fmt.
Several files at once
Reads main.tf, variables.tf and others together, and matches variable, local and module definitions across files.
Use cases
- Check before committing that passwords or access keys are not written directly in a .tf
- Check whether a security group allows SSH or RDP from 0.0.0.0/0
- See at a glance whether provider and module versions are pinned
- Find the line of an HCL syntax error where you cannot run terraform
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Reading .tf (HCL) and listing blocks (several files) | Supported | — |
| Hardcoded secrets, sensitive and unpinned versions | Partial | Only items judged by name and shape. No finding does not mean safe |
| SSH and RDP from 0.0.0.0/0 in aws_security_group and similar, S3 ACLs | Partial | Only some AWS resources. Ports given by a variable are not judged |
| Undefined var., local. and module. references, and duplicate definitions | Supported | — |
| Formatting indentation and = alignment | Partial | The result is not identical to terraform fmt |
| Reading plan, apply or state files | Not supported | Nothing is run and no state is read |
| Validating against provider schemas (attribute names and types) | Not supported | Misspelled attributes and wrong types are not flagged |
| Validating .tf.json (JSON syntax) and .tfvars | Not supported | Only text written in the .tf syntax is read |
Limits & notes
- Input is limited to 400,000 characters in total, 30 files and 300 KB per file. Anything beyond is not read, and you are told.
- Provider schemas are not available, so misspelled attributes, missing required attributes and wrong value types are not flagged.
- Findings are judged from the strings and names as written. Values built with variables or functions, and the inside of other modules, are not followed.
- Undefined references are searched only within what you pasted. They are not checked when there is a syntax error.
Privacy & safety
Pasted .tf text and dropped files are processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.
FAQ
Is the output the same as terraform fmt?
Why is SSH from 0.0.0.0/0 a problem?
Does sensitive = true make a secret safe?
How do I pin a provider version?
It reports an undefined reference, but I did define it.
Related tools
Kubernetes Manifest Studio
Paste Deployment, Service or other manifests to list the resources and see which Deployment a Service's selector reaches. It flags removed apiVersions, latest or missing image tags, missing requests and limits, and risky securityContext settings, each with a line number. It does not fully validate the schema, so use it as a review aid before you apply anything to a cluster.
GitHub Actions Studio
Paste a workflow YAML to see its triggers (on), its jobs in needs order, and the uses and run of each step. It flags places where a value anyone can write is expanded straight into run (script injection), actions pinned to a tag or branch, and jobs without permissions, each with a line number. It does not fully validate the schema or run the workflow.
.env Studio
Paste or drop a .env file to see its keys and values in a table, with duplicates, empty values and syntax problems flagged by line. Values are hidden by default. You can compare a .env with a .env.example, or export an example file, JSON or a Kubernetes Secret. It checks common dotenv syntax, not tool-specific rules such as docker compose variable expansion.
Lockfile Diff & Dependency Tree
Compare two lockfiles to see which packages were added, removed or upgraded. You can also see why a package is installed and where several versions of one package come from. Nothing leaves your browser.
Docker Compose Studio
Convert docker run commands to compose.yaml, or compose.yaml back to docker run. A compose file is checked for syntax, the Compose Specification and common mistakes, and security points worth confirming are listed. Nothing is started or pulled, and your input never leaves your device.
Dockerfile Studio
Paste a Dockerfile to check its syntax, stages and common mistakes. Secret-looking values and points to confirm, such as curl | sh, are listed with line numbers. You can also format it or generate starter files for Node.js, Python, Go, a static site or Java. Nothing is built, and your input never leaves your device.
Last updated: