Skip to main content
Book Consultation →
Developer helpers100% FreeInstant

.npmrc Validator: Check npm Config Files

This free tool checks the lines of an .npmrc file. It finds syntax errors, repeated keys, secrets stored in plain text, registries that do not use HTTPS and values that npm would not accept, and it explains each setting it knows.

By Debmedia Technologies LLP · Kolkata, India · Updated

What Is It and When Do You Need It?

The .npmrc file controls where npm gets packages and how it logs in. A typo or a leaked token causes failed installs or a security problem.

Paste the file and read the report.

How to Use This Tool

  1. Enter or paste your input in the box or boxes above.
  2. Choose the options, if there are any.
  3. Press the button to run the tool.
  4. Read the result and use the copy button where one is shown.

How the Calculation Works

Each line is read as a comment, a blank line or key=value. The tool checks the key against a list of known npm settings, checks values for yes/no settings, checks that registry values are URLs that use https, spots auth keys that hold a real value rather than an environment variable, and reports keys that appear twice.

Worked Example

A line //npm.myco.com/:_authToken=abc123 is flagged as a token in plain text, while ${NPM_TOKEN} is accepted.

Common Uses

  • Reviewing project setup.
  • Fixing install errors.
  • Security checks before a commit.
  • Teaching npm.

Tips and Common Mistakes

  • Keep user tokens in your home .npmrc, not in the project.
  • Use environment variables in CI.
  • Run npm config list to see what npm really uses.
  • Check the first result against a case you already know, so you can trust the tool for the rest.
  • Nothing you type leaves your device. The work is done by your browser, so it also works with a slow connection once the page has loaded.

Next, you may need the package.json validator, query string parser, JSON formatter and validator, CSV and JSON converter.

Everything runs in your browser. Nothing you type is uploaded, stored or sent to any outside service.

Frequently Asked Questions

A plain text file where npm reads its settings, with one key=value per line. Lines starting with # or ; are comments.
An auth token in a file that is committed to Git can be stolen and used to publish or read private packages. Use an environment variable like ${NPM_TOKEN} instead.
A line like @myco:registry=https://... tells npm to fetch packages with the @myco scope from another registry.
No. It does not connect to anything. It only checks the text of the file.

Disclaimer: results are calculated in your browser from the numbers you enter. Check important results before you rely on them for money, health, safety or legal decisions.