For loading a plain key value file, yes. Node.js can load environment variables from a file with the --env-file flag, so a small app may not need the dotenv package. The flag is stable from Node 24.10 and 22.21. Remember that either way the file is still a secret that must stay out of git.
Definition
--env-file=file loads variables from a file, relative to the current directory, into process.env. The Node.js CLI documentation says the flag is no longer experimental from v24.10.0 and v22.21.0, and that multi line values are supported from v21.7.0 and v20.12.0. It was added in v20.6.0.
How it behaves
| Behavior | Documented rule |
|---|---|
| Variable in both environment and file | The environment value wins |
| Several files | Later files override earlier ones |
| Missing file | An error is thrown |
| Optional file | Use --env-file-if-exists (stable from 24.10 and 22.21) |
| Node's own variables | Ones like NODE_OPTIONS in the file are parsed and applied |
The precedence rule is the useful one for safety. A real environment variable set by your platform beats a stale value in a file, so a leftover local file cannot silently override production configuration.
Using it
node --env-file=.env --env-file=.env.local server.js
The file format is one name and value per line, separated by an equals sign, such as PORT=3000.
Compare the options
| Question | --env-file | dotenv package |
|---|---|---|
| Extra dependency | None | Yes, one more package to track |
| Runs inside your code | No, at process start | Yes, on require or import |
| Needs a minimum Node version | Yes, see above | Runs on older versions |
| Works in worker threads and tools | Per process flag | Depends on how you load it |
Fewer packages means fewer things to audit, but only if the version of Node you run supports the flag as stable. Check which Node.js version to run in production first.
Steps
- Confirm your Node version supports --env-file as stable.
- Add
.envand variants to .gitignore, and commit a.env.examplewith fake values. - Use --env-file-if-exists for optional local overrides so production does not fail on a missing file.
- In production, prefer variables injected by your platform, and treat the file as a development convenience.
- If you drop dotenv, remove it from package.json and the lockfile in the same change.
Security note on the flag: it can set NODE_OPTIONS, so anyone who can write to the file can change how Node starts. Protect file permissions accordingly. See also where should a Node app keep secrets.
Safeguard's SBOM and dependency scanning lists direct and transitive packages, so removing one is easy to verify. Free scan: gold.safeguard.sh/scan.
Quick check
If dotenv and --env-file both load the same variable, which wins?
For --env-file the docs say an existing environment value takes precedence over the file. For dotenv, check its documentation, since behavior can differ.
Should I commit my .env file if it has no real secrets?
Commit an example file with placeholder values instead. Real files tend to collect real values over time.
Sources
Last reviewed: 19 October 2026.
