Repository navigation
Add strict parameter to load_dotenv() and dotenv_values() for fail-fast behavior #631
Description
Activity
- added 4 commits that reference this issue
on Mar 15, 2026 Hey folks! 👋 This issue and the accompanying PR (#632) implement a
strictmode that addresses the silent failure problems many of you have raised over the years. I'd love to hear your thoughts on the approach.Tagging people who've been involved in related issues/PRs:
- @Qwerty-133 — you opened Raise exceptions when encountering errors in files. #467 requesting exceptions on errors
- @rptaylor — you opened requireFile option for strict checking of env file existence #297 requesting strict file existence checking, and commented on load_dotenv() returns True even if .env file is not found #321
- @scollovati — you opened load_dotenv() returns True even if .env file is not found #321 about
load_dotenv()returningTrueon missing files - @mtmail — you opened PR File parsing: Option to raise exception instead of warning #520 implementing parse-error exceptions
- @HairlessVillager — you opened Feature Request: Exception or Warning on Duplicate Configuration Items #591 about duplicate config handling
- @bandtank — you opened dotenv_load with bad file path doesn't error #164 about bad file paths not erroring
And others who commented on these issues:
@iamsannyrai @ethsanders @larsks @cbarkinozer @kaskogsholm @reorx @guhcampos @kvfi @drkarthi @srgykuz @mbUSCTL;DR of the proposal:
# Existing behavior unchanged (strict=False by default) load_dotenv() # Opt-in strict mode load_dotenv(strict=True) # → FileNotFoundError if .env missing # → ValueError if any line can't be parsed
100% backwards compatible, opt-in only. The PR is up at #632 — would appreciate your feedback on whether this covers your use cases!
Thanks for the update. It looks like a decent solution. I do not recall the nuances of the problem because I moved away from dotenv a few years ago.
Reacted by Ahsan SherazWhat about load_dotenv silently looking at parent directories for .env file and loading them? this is very problematic and insecure default behaviour which is not clearly documented and can lead to destroying production resources if inadvertedly loads wrong credentials from a parent directory such as user home.
Problem
python-dotenv currently fails silently in two critical scenarios:
1. Missing
.envfile — no error raisedWhile PR #388 improved this to return
False(previously returnedTrue), almost no one checks the return value. The common pattern is justload_dotenv()at the top of a module.2. Invalid lines — silently logged as warnings
As described in PR #520: "I dealt with an .env file that accidentally contained an unparsable line. The software then set a default value and I almost wrote to a wrong database."
Community Demand
This is one of the most requested features, spanning multiple years:
The DEV Community article "Why load_dotenv() Is an Anti-Pattern" (2025) specifically calls out silent failures as the primary reason developers migrate away from python-dotenv to alternatives like pydantic-settings.
Proposal
Add a
strictparameter (defaultFalse) toload_dotenv()anddotenv_values():Behavior with
strict=True:strict=True.envfile not foundFalsesilentlyFileNotFoundErrorlogger.warning()ValueErrorwith line numberTrueTrue(unchanged)Interaction with
verbosestricttakes precedence oververbose. When both areTrue, the exception is raised without emitting a warning first — logging the same message before raising would be an anti-pattern (the exception already carries the information). Whenstrict=False,verbosecontinues to work as before.strictverboseFalseFalseFalse)FalseTruelogger.info()warningTrueFalseFileNotFoundErrorTrueTrueFileNotFoundError(no warning logged)Design Philosophy — Parser Correctness, Not Config Validation
This proposal intentionally stays within python-dotenv's existing philosophy of "populate what is available, let consuming code validate requirements."
strictmode does not validate whether specific keys exist, whether values are the correct type, or whether the configuration is "complete" — that is the domain of tools like pydantic-settings.What
strictdoes is make python-dotenv honest about its own job: "did the file I was asked to read exist?" and "could I parse every line in it?" These are parser-level guarantees, not application-level config validation. The library should be able to tell you when it failed to do what you asked, rather than silently pretending everything is fine.Backwards Compatibility
False, no behavior change for existing usersstrict=TrueScope
This addresses the umbrella of issues (#467, #297, #520, #591) with a single, clean API addition. The implementation touches
main.pyonly (~20-30 lines), plus tests.Related: #467, #297, #321, #520, #591, #164