diff --git a/CLAUDE.md b/CLAUDE.md
index 2efe8b027..e6e2750a1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -68,3 +68,7 @@ Laravel 12 (L10 structure), PHP 8.4, Inertia v2, React 19, Tailwind v4, PHPUnit
 
 - Use `gh` CLI for issues/PRs.
 - Don't change dependencies or create new base folders without approval.
+
+## SSH
+
+- All SSH commands are being run using app/Helpers/SSH.php
diff --git a/app/Actions/Site/UpdateEnv.php b/app/Actions/Site/UpdateEnv.php
index 0122cc61a..ecfff82f8 100644
--- a/app/Actions/Site/UpdateEnv.php
+++ b/app/Actions/Site/UpdateEnv.php
@@ -3,6 +3,7 @@
 namespace App\Actions\Site;
 
 use App\Exceptions\SSHError;
+use App\Helpers\EnvParser;
 use App\Models\Site;
 use Illuminate\Support\Facades\Validator;
 
@@ -16,19 +17,70 @@ class UpdateEnv
     public function update(Site $site, array $input): void
     {
         Validator::make($input, [
-            'env' => ['required', 'string'],
+            'env' => ['required_without:variables', 'nullable', 'string'],
+            'variables' => ['required_without:env', 'nullable', 'array'],
+            'variables.*.key' => ['required_with:variables', 'string'],
+            'variables.*.value' => ['nullable', 'string'],
+            'variables.*.is_secret' => ['nullable', 'boolean'],
             'path' => ['nullable', 'string'],
         ])->validate();
 
         $typeData = $site->type_data ?? [];
         $path = $input['path'] ?? data_get($typeData, 'env_path', $site->path.'/.env');
 
+        $variables = $this->processVariables($site, $input);
+
+        $envContent = EnvParser::stringify($variables);
+
         $site->server->os()->write(
             $path,
-            trim((string) $input['env']),
+            $envContent,
             $site->user,
         );
 
+        $site->env_variables = $variables;
+        $site->save();
+
         $site->jsonUpdate('type_data', 'env_path', $path);
     }
+
+    /**
+     * Process incoming variables, merging with stored secrets
+     *
+     * @param  array<string, mixed>  $input
+     * @return array<int, array{key: string, value: string, is_secret: bool}>
+     */
+    private function processVariables(Site $site, array $input): array
+    {
+        if (isset($input['variables']) && is_array($input['variables'])) {
+            $incoming = array_map(function ($var) {
+                return [
+                    'key' => $var['key'] ?? '',
+                    'value' => $var['value'] ?? '',
+                    'is_secret' => (bool) ($var['is_secret'] ?? false),
+                ];
+            }, $input['variables']);
+
+            return EnvParser::mergeWithStored($incoming, $site->env_variables);
+        }
+
+        $parsed = EnvParser::parse(trim((string) $input['env']));
+
+        if ($site->env_variables) {
+            $storedMap = [];
+            foreach ($site->env_variables as $var) {
+                $storedMap[$var['key']] = $var;
+            }
+
+            return array_map(function ($var) use ($storedMap) {
+                if (isset($storedMap[$var['key']])) {
+                    $var['is_secret'] = $storedMap[$var['key']]['is_secret'];
+                }
+
+                return $var;
+            }, $parsed);
+        }
+
+        return $parsed;
+    }
 }
diff --git a/app/Helpers/EnvParser.php b/app/Helpers/EnvParser.php
new file mode 100644
index 000000000..cd8f2cc89
--- /dev/null
+++ b/app/Helpers/EnvParser.php
@@ -0,0 +1,163 @@
+<?php
+
+namespace App\Helpers;
+
+class EnvParser
+{
+    /**
+     * Secret key patterns - keys containing these words are considered secrets
+     *
+     * @var array<string>
+     */
+    private const SECRET_PATTERNS = ['PASSWORD', 'SECRET', 'TOKEN', 'KEY', 'PRIVATE'];
+
+    /**
+     * Check if an env key should be treated as a secret
+     */
+    public static function isSecretKey(string $key): bool
+    {
+        $upperKey = strtoupper($key);
+
+        foreach (self::SECRET_PATTERNS as $pattern) {
+            if (str_contains($upperKey, $pattern)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Parse a raw .env string into an array of variables
+     *
+     * @return array<int, array{key: string, value: string, is_secret: bool}>
+     */
+    public static function parse(string $raw): array
+    {
+        $variables = [];
+        $lines = explode("\n", $raw);
+
+        foreach ($lines as $line) {
+            $trimmedLine = trim($line);
+
+            // Skip empty lines and comments
+            if ($trimmedLine === '' || str_starts_with($trimmedLine, '#')) {
+                continue;
+            }
+
+            // Find the first equals sign (key can't contain =, but value can)
+            $equalsIndex = strpos($trimmedLine, '=');
+            if ($equalsIndex === false) {
+                continue;
+            }
+
+            $key = trim(substr($trimmedLine, 0, $equalsIndex));
+            $value = substr($trimmedLine, $equalsIndex + 1);
+
+            // Remove surrounding quotes if present
+            if (
+                (str_starts_with($value, '"') && str_ends_with($value, '"')) ||
+                (str_starts_with($value, "'") && str_ends_with($value, "'"))
+            ) {
+                $value = substr($value, 1, -1);
+            }
+
+            // Handle escaped newlines in quoted strings
+            $value = str_replace('\\n', "\n", $value);
+
+            if ($key !== '') {
+                $variables[] = [
+                    'key' => $key,
+                    'value' => $value,
+                    'is_secret' => self::isSecretKey($key),
+                ];
+            }
+        }
+
+        return $variables;
+    }
+
+    /**
+     * Convert an array of variables back to a raw .env string
+     *
+     * @param  array<int, array{key: string, value: string}>  $variables
+     */
+    public static function stringify(array $variables): string
+    {
+        $lines = [];
+
+        foreach ($variables as $variable) {
+            $key = trim($variable['key']);
+            $value = $variable['value'];
+
+            if ($key === '') {
+                continue;
+            }
+
+            $needsQuotes = str_contains($value, "\n") ||
+                str_contains($value, ' ') ||
+                str_contains($value, '"') ||
+                str_contains($value, "'") ||
+                str_contains($value, '#');
+
+            if ($needsQuotes) {
+                $escapedValue = str_replace(["\n", '"'], ['\\n', '\\"'], $value);
+                $lines[] = "{$key}=\"{$escapedValue}\"";
+            } else {
+                $lines[] = "{$key}={$value}";
+            }
+        }
+
+        return implode("\n", $lines);
+    }
+
+    /**
+     * Mask secret values for frontend display
+     * Secret values are completely hidden (not sent to frontend)
+     *
+     * @param  array<int, array{key: string, value: string, is_secret: bool}>  $variables
+     * @return array<int, array{key: string, value: string, is_secret: bool}>
+     */
+    public static function maskSecrets(array $variables): array
+    {
+        return array_map(function ($variable) {
+            if ($variable['is_secret']) {
+                $variable['value'] = '';
+            }
+
+            return $variable;
+        }, $variables);
+    }
+
+    /**
+     * Merge incoming variables with stored variables
+     * For secrets with empty values, keep the stored value
+     *
+     * @param  array<int, array{key: string, value: string, is_secret: bool}>  $incoming
+     * @param  array<int, array{key: string, value: string, is_secret: bool}>|null  $stored
+     * @return array<int, array{key: string, value: string, is_secret: bool}>
+     */
+    public static function mergeWithStored(array $incoming, ?array $stored): array
+    {
+        if ($stored === null) {
+            return $incoming;
+        }
+
+        $storedMap = [];
+        foreach ($stored as $variable) {
+            $storedMap[$variable['key']] = $variable;
+        }
+
+        return array_map(function ($variable) use ($storedMap) {
+            $key = $variable['key'];
+            $isSecret = $variable['is_secret'];
+            $value = $variable['value'];
+
+            if ($isSecret && $value === '' && isset($storedMap[$key])) {
+                $variable['value'] = $storedMap[$key]['value'];
+            }
+
+            return $variable;
+        }, $incoming);
+    }
+}
diff --git a/app/Http/Controllers/API/SiteController.php b/app/Http/Controllers/API/SiteController.php
index 3db23bb27..2607fe006 100644
--- a/app/Http/Controllers/API/SiteController.php
+++ b/app/Http/Controllers/API/SiteController.php
@@ -10,6 +10,7 @@
 use App\Actions\Site\UpdateLoadBalancer;
 use App\Actions\Site\UpdateWebDirectory;
 use App\Exceptions\DeploymentScriptIsEmptyException;
+use App\Helpers\EnvParser;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\DeploymentResource;
 use App\Http\Resources\SiteResource;
@@ -157,9 +158,18 @@ public function showEnv(Project $project, Server $server, Site $site): JsonRespo
 
         $this->validateRoute($project, $server, $site);
 
+        $env = $site->getEnv();
+
+        if ($site->env_variables !== null) {
+            $variables = EnvParser::maskSecrets($site->env_variables);
+        } else {
+            $variables = EnvParser::parse($env);
+        }
+
         return response()->json([
             'data' => [
-                'env' => $site->getEnv(),
+                'env' => $env,
+                'variables' => $variables,
             ],
         ]);
     }
diff --git a/app/Http/Controllers/ApplicationController.php b/app/Http/Controllers/ApplicationController.php
index 171658988..4a36a40e9 100644
--- a/app/Http/Controllers/ApplicationController.php
+++ b/app/Http/Controllers/ApplicationController.php
@@ -11,6 +11,7 @@
 use App\Exceptions\FailedToDestroyGitHook;
 use App\Exceptions\SourceControlIsNotConnected;
 use App\Exceptions\SSHError;
+use App\Helpers\EnvParser;
 use App\Http\Resources\DeploymentResource;
 use App\Http\Resources\DeploymentScriptResource;
 use App\Http\Resources\LoadBalancerServerResource;
@@ -118,8 +119,31 @@ public function env(Request $request, Server $server, Site $site): JsonResponse
 
         $env = $site->getEnv();
 
+        if ($site->env_variables !== null) {
+            $variables = EnvParser::maskSecrets($site->env_variables);
+        } else {
+            $variables = EnvParser::parse($env);
+        }
+
         return response()->json([
             'env' => $env,
+            'variables' => $variables,
+        ]);
+    }
+
+    #[Post('/env/parse', name: 'application.parse-env')]
+    public function parseEnv(Request $request, Server $server, Site $site): JsonResponse
+    {
+        $this->authorize('view', [$site, $server]);
+
+        $request->validate([
+            'content' => ['required', 'string'],
+        ]);
+
+        $variables = EnvParser::parse($request->input('content'));
+
+        return response()->json([
+            'variables' => $variables,
         ]);
     }
 
diff --git a/app/Models/Site.php b/app/Models/Site.php
index 6942f6d3f..b97a32717 100755
--- a/app/Models/Site.php
+++ b/app/Models/Site.php
@@ -27,6 +27,7 @@
  * @property int $server_id
  * @property string $type
  * @property array<string, mixed> $type_data
+ * @property ?array<int, array{key: string, value: string, is_secret: bool}> $env_variables
  * @property string $domain
  * @property array<int, string> $aliases
  * @property string $web_directory
@@ -72,6 +73,7 @@ class Site extends AbstractModel
         'server_id',
         'type',
         'type_data',
+        'env_variables',
         'domain',
         'aliases',
         'web_directory',
@@ -92,6 +94,7 @@ class Site extends AbstractModel
     protected $casts = [
         'server_id' => 'integer',
         'type_data' => 'json',
+        'env_variables' => 'encrypted:array',
         'port' => 'integer',
         'progress' => 'integer',
         'aliases' => 'array',
diff --git a/database/migrations/2026_01_01_151401_add_env_variables_to_sites_table.php b/database/migrations/2026_01_01_151401_add_env_variables_to_sites_table.php
new file mode 100644
index 000000000..7ce7706ae
--- /dev/null
+++ b/database/migrations/2026_01_01_151401_add_env_variables_to_sites_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('sites', function (Blueprint $table) {
+            $table->text('env_variables')->nullable()->after('type_data');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('sites', function (Blueprint $table) {
+            $table->dropColumn('env_variables');
+        });
+    }
+};
diff --git a/public/api-docs/openapi/sites.yaml b/public/api-docs/openapi/sites.yaml
index 62ba65508..c4e2582c3 100644
--- a/public/api-docs/openapi/sites.yaml
+++ b/public/api-docs/openapi/sites.yaml
@@ -708,7 +708,7 @@ paths:
   /api/projects/{project}/servers/{server}/sites/{site}/env:
     get:
       summary: Get environment variables
-      description: Get site environment variables
+      description: Get site environment variables. Returns both raw env content and structured variables array.
       tags:
         - Sites
       security:
@@ -747,20 +747,40 @@ paths:
                     type: object
                     properties:
                       env:
-                        type: object
-                        additionalProperties:
-                          type: string
-                        description: Environment variables
-                        example:
-                          APP_NAME: 'My App'
-                          APP_ENV: 'production'
-                          APP_DEBUG: 'false'
+                        type: string
+                        description: Raw .env file content
+                        example: "APP_NAME=MyApp\nAPP_ENV=production"
+                      variables:
+                        type: array
+                        description: Parsed environment variables
+                        items:
+                          type: object
+                          properties:
+                            key:
+                              type: string
+                              description: Variable name
+                              example: 'APP_NAME'
+                            value:
+                              type: string
+                              description: Variable value
+                              example: 'MyApp'
+                            is_secret:
+                              type: boolean
+                              description: Whether the variable contains sensitive data (PASSWORD, SECRET, TOKEN, KEY, PRIVATE)
+                              example: false
               example:
                 data:
-                  env:
-                    APP_NAME: 'My App'
-                    APP_ENV: 'production'
-                    APP_DEBUG: 'false'
+                  env: "APP_NAME=MyApp\nAPP_ENV=production\nDB_PASSWORD=secret123"
+                  variables:
+                    - key: 'APP_NAME'
+                      value: 'MyApp'
+                      is_secret: false
+                    - key: 'APP_ENV'
+                      value: 'production'
+                      is_secret: false
+                    - key: 'DB_PASSWORD'
+                      value: 'secret123'
+                      is_secret: true
         '401':
           description: Unauthorized
           content:
@@ -782,7 +802,7 @@ paths:
 
     put:
       summary: Update environment variables
-      description: Update site environment variables
+      description: Update site environment variables. You can provide either raw env content or structured variables array.
       tags:
         - Sites
       security:
@@ -815,23 +835,44 @@ paths:
           application/json:
             schema:
               type: object
-              required:
-                - env
               properties:
                 env:
-                  type: object
-                  additionalProperties:
-                    type: string
-                  description: Environment variables
-                  example:
-                    APP_NAME: 'My App'
-                    APP_ENV: 'production'
-                    APP_DEBUG: 'false'
-            example:
-              env:
-                APP_NAME: 'My App'
-                APP_ENV: 'production'
-                APP_DEBUG: 'false'
+                  type: string
+                  description: Raw .env file content (use this OR variables, not both)
+                  example: "APP_NAME=MyApp\nAPP_ENV=production"
+                variables:
+                  type: array
+                  description: Structured environment variables (use this OR env, not both)
+                  items:
+                    type: object
+                    required:
+                      - key
+                    properties:
+                      key:
+                        type: string
+                        description: Variable name
+                        example: 'APP_NAME'
+                      value:
+                        type: string
+                        description: Variable value
+                        example: 'MyApp'
+                path:
+                  type: string
+                  description: Custom path to the .env file
+                  example: '/home/vito/myapp/.env'
+            examples:
+              raw:
+                summary: Using raw env content
+                value:
+                  env: "APP_NAME=MyApp\nAPP_ENV=production"
+              structured:
+                summary: Using structured variables
+                value:
+                  variables:
+                    - key: 'APP_NAME'
+                      value: 'MyApp'
+                    - key: 'APP_ENV'
+                      value: 'production'
       responses:
         '200':
           description: Environment variables updated successfully
diff --git a/resources/js/components/ui/auto-grow-textarea.tsx b/resources/js/components/ui/auto-grow-textarea.tsx
new file mode 100644
index 000000000..b75aad6b7
--- /dev/null
+++ b/resources/js/components/ui/auto-grow-textarea.tsx
@@ -0,0 +1,57 @@
+import * as React from 'react';
+import { cn } from '@/lib/utils';
+import { useInputFocus } from '@/stores/useInputFocus';
+
+type AutoGrowTextareaProps = React.ComponentProps<'textarea'>;
+
+const MAX_HEIGHT = 200; // Maximum height in pixels before scrolling
+
+const AutoGrowTextarea = React.forwardRef<HTMLTextAreaElement, AutoGrowTextareaProps>(({ className, value, onChange, ...props }, ref) => {
+  const setFocused = useInputFocus((state) => state.setFocused);
+  const textareaRef = React.useRef<HTMLTextAreaElement>(null);
+
+  // Combine refs
+  React.useImperativeHandle(ref, () => textareaRef.current as HTMLTextAreaElement);
+
+  const adjustHeight = React.useCallback(() => {
+    const textarea = textareaRef.current;
+    if (textarea) {
+      textarea.style.height = 'auto';
+      const newHeight = Math.min(textarea.scrollHeight, MAX_HEIGHT);
+      textarea.style.height = `${newHeight}px`;
+      textarea.style.overflowY = textarea.scrollHeight > MAX_HEIGHT ? 'auto' : 'hidden';
+    }
+  }, []);
+
+  React.useEffect(() => {
+    adjustHeight();
+  }, [value, adjustHeight]);
+
+  const handleChange = (e: React.ChangeEvent<HTMLTextAreaElement>) => {
+    onChange?.(e);
+    adjustHeight();
+  };
+
+  return (
+    <textarea
+      ref={textareaRef}
+      data-slot="textarea"
+      value={value}
+      onChange={handleChange}
+      rows={1}
+      className={cn(
+        'border-input placeholder:text-muted-foreground dark:bg-input/30 flex min-h-9 w-full min-w-0 resize-none rounded-md border bg-transparent px-3 py-[5px] text-base leading-[24px] shadow-xs transition-[color,box-shadow] outline-none disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm',
+        'focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px]',
+        'aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive',
+        className,
+      )}
+      onFocus={() => setFocused(true)}
+      onBlur={() => setFocused(false)}
+      {...props}
+    />
+  );
+});
+
+AutoGrowTextarea.displayName = 'AutoGrowTextarea';
+
+export { AutoGrowTextarea };
diff --git a/resources/js/pages/application/components/env-variable-row.tsx b/resources/js/pages/application/components/env-variable-row.tsx
new file mode 100644
index 000000000..899de0aca
--- /dev/null
+++ b/resources/js/pages/application/components/env-variable-row.tsx
@@ -0,0 +1,195 @@
+import React, { useState } from 'react';
+import { EyeIcon, EyeOffIcon, LockIcon, TrashIcon, UnlockIcon } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { AutoGrowTextarea } from '@/components/ui/auto-grow-textarea';
+import { EnvVariable } from '@/types/env';
+import { cn } from '@/lib/utils';
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
+
+interface EnvVariableRowProps {
+  variable: EnvVariable;
+  onChange: (variable: EnvVariable) => void;
+  onDelete: () => void;
+  error?: string;
+}
+
+export default function EnvVariableRow({ variable, onChange, onDelete, error }: EnvVariableRowProps) {
+  const [showValue, setShowValue] = useState(false);
+  const isMultiLine = variable.value.includes('\n');
+
+  // Existing secrets (not new) cannot be shown - they weren't sent from server
+  const isExistingSecret = variable.isSecret && !variable.isNew;
+
+  const handleKeyChange = (e: React.ChangeEvent<HTMLInputElement>) => {
+    onChange({ ...variable, key: e.target.value });
+  };
+
+  const handleValueChange = (e: React.ChangeEvent<HTMLInputElement | HTMLTextAreaElement>) => {
+    onChange({ ...variable, value: e.target.value });
+  };
+
+  const toggleSecret = () => {
+    // Only new variables can toggle their secret status
+    if (variable.isNew) {
+      onChange({ ...variable, isSecret: !variable.isSecret });
+    }
+  };
+
+  const renderValueInput = () => {
+    // Existing secret: show placeholder, user can toggle visibility once they start typing
+    if (isExistingSecret) {
+      const hasNewValue = variable.value.length > 0;
+
+      if (!showValue) {
+        return (
+          <div className="relative min-h-9 flex-1">
+            <Input
+              type="password"
+              value={variable.value}
+              onChange={handleValueChange}
+              placeholder="Enter new value to change..."
+              className="h-9 w-full pr-10"
+            />
+            <button
+              type="button"
+              className={cn(
+                'absolute top-0 right-0 flex h-9 w-9 items-center justify-center',
+                hasNewValue ? 'text-muted-foreground hover:text-foreground' : 'text-muted-foreground/50 pointer-events-none',
+              )}
+              onClick={() => hasNewValue && setShowValue(true)}
+              aria-label="Show value"
+              disabled={!hasNewValue}
+            >
+              <EyeIcon className="size-4" aria-hidden="true" />
+            </button>
+          </div>
+        );
+      }
+
+      return (
+        <div className="relative min-h-9 flex-1">
+          <AutoGrowTextarea value={variable.value} onChange={handleValueChange} placeholder="Enter new value to change..." className="w-full pr-10" />
+          <button
+            type="button"
+            className="text-muted-foreground hover:text-foreground absolute top-0 right-0 flex h-9 w-9 items-center justify-center"
+            onClick={() => setShowValue(false)}
+            aria-label="Hide value"
+          >
+            <EyeOffIcon className="size-4" aria-hidden="true" />
+          </button>
+        </div>
+      );
+    }
+
+    // New secret with toggle visibility
+    if (variable.isSecret && variable.isNew) {
+      if (!showValue) {
+        return (
+          <div className="relative min-h-9 flex-1">
+            <Input type="password" value={variable.value} onChange={handleValueChange} placeholder="Enter value..." className="h-9 w-full pr-10" />
+            <button
+              type="button"
+              className="text-muted-foreground hover:text-foreground absolute top-0 right-0 flex h-9 w-9 items-center justify-center"
+              onClick={() => setShowValue(true)}
+              aria-label="Show value"
+            >
+              <EyeIcon className="size-4" aria-hidden="true" />
+            </button>
+          </div>
+        );
+      }
+
+      return (
+        <div className="relative min-h-9 flex-1">
+          <AutoGrowTextarea value={variable.value} onChange={handleValueChange} placeholder="Enter value..." className="w-full pr-10" />
+          <button
+            type="button"
+            className="text-muted-foreground hover:text-foreground absolute top-0 right-0 flex h-9 w-9 items-center justify-center"
+            onClick={() => setShowValue(false)}
+            aria-label="Hide value"
+          >
+            <EyeOffIcon className="size-4" aria-hidden="true" />
+          </button>
+        </div>
+      );
+    }
+
+    // Non-secret value - use AutoGrowTextarea for multiline support
+    return (
+      <div className="min-h-9 flex-1">
+        <AutoGrowTextarea value={variable.value} onChange={handleValueChange} placeholder="Enter value..." className="w-full" />
+      </div>
+    );
+  };
+
+  const renderSecretToggle = () => {
+    // Only show toggle for new variables, but keep placeholder for alignment
+    if (!variable.isNew) {
+      return <div className="size-9 shrink-0" />;
+    }
+
+    return (
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <Button
+            type="button"
+            variant="ghost"
+            size="icon"
+            onClick={toggleSecret}
+            className={cn('shrink-0', variable.isSecret ? 'text-warning' : 'text-muted-foreground')}
+          >
+            {variable.isSecret ? <LockIcon className="size-4" /> : <UnlockIcon className="size-4" />}
+          </Button>
+        </TooltipTrigger>
+        <TooltipContent>{variable.isSecret ? 'Secret (click to make normal)' : 'Normal (click to make secret)'}</TooltipContent>
+      </Tooltip>
+    );
+  };
+
+  const renderKeyInput = () => {
+    const isExisting = !variable.isNew;
+    const hasError = !!error;
+
+    if (isExisting && variable.isSecret) {
+      return (
+        <div className={cn('relative', isMultiLine ? 'w-full sm:w-72' : 'w-72')}>
+          <Input value={variable.key} onChange={handleKeyChange} placeholder="KEY" className="pr-9 font-mono" disabled />
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <div className="text-muted-foreground absolute top-0 right-0 flex h-9 w-9 items-center justify-center">
+                <LockIcon className="size-4" />
+              </div>
+            </TooltipTrigger>
+            <TooltipContent>This is a secret variable</TooltipContent>
+          </Tooltip>
+        </div>
+      );
+    }
+
+    return (
+      <div className={cn(isMultiLine ? 'w-full sm:w-72' : 'w-72')}>
+        <Input
+          value={variable.key}
+          onChange={handleKeyChange}
+          placeholder="KEY"
+          className={cn('font-mono', hasError && 'border-destructive')}
+          disabled={isExisting}
+          aria-invalid={hasError}
+        />
+        {hasError && <p className="text-destructive mt-1 text-xs">{error}</p>}
+      </div>
+    );
+  };
+
+  return (
+    <div className={cn('flex items-start gap-2', isMultiLine && 'flex-col sm:flex-row')}>
+      {renderKeyInput()}
+      {renderValueInput()}
+      {renderSecretToggle()}
+      <Button type="button" variant="ghost" size="icon" onClick={onDelete} className="text-muted-foreground hover:text-destructive shrink-0">
+        <TrashIcon className="size-4" />
+      </Button>
+    </div>
+  );
+}
diff --git a/resources/js/pages/application/components/env.tsx b/resources/js/pages/application/components/env.tsx
index 8e7629256..3ac2dfee4 100644
--- a/resources/js/pages/application/components/env.tsx
+++ b/resources/js/pages/application/components/env.tsx
@@ -1,28 +1,66 @@
-import React, { FormEvent, ReactNode, useState } from 'react';
+import React, { FormEvent, ReactNode, useMemo, useRef, useState } from 'react';
 import { useForm } from '@inertiajs/react';
 import { useQuery } from '@tanstack/react-query';
 import axios from 'axios';
-import { Editor, useMonaco } from '@monaco-editor/react';
 import { Sheet, SheetClose, SheetContent, SheetDescription, SheetFooter, SheetHeader, SheetTitle, SheetTrigger } from '@/components/ui/sheet';
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
 import { Form } from '@/components/ui/form';
 import { Skeleton } from '@/components/ui/skeleton';
 import { Button } from '@/components/ui/button';
-import { LoaderCircleIcon, RefreshCwIcon } from 'lucide-react';
-import { registerDotEnvLanguage } from '@/lib/editor';
+import { Alert, AlertDescription } from '@/components/ui/alert';
+import { LoaderCircleIcon, PlusIcon, RefreshCwIcon, UploadIcon, AlertCircleIcon, ClipboardIcon } from 'lucide-react';
 import { Site } from '@/types/site';
-import { useAppearance } from '@/hooks/use-appearance';
 import { Input } from '@/components/ui/input';
 import { useInputFocus } from '@/stores/useInputFocus';
+import { EnvVariable } from '@/types/env';
+import EnvVariableRow from './env-variable-row';
+
+function generateUniqueKey(existingKeys: string[]): string {
+  let counter = 1;
+  let newKey = 'NEW_VARIABLE';
+
+  while (existingKeys.includes(newKey)) {
+    newKey = `NEW_VARIABLE_${counter}`;
+    counter++;
+  }
+
+  return newKey;
+}
 
 export default function Env({ site, children }: { site: Site; children: ReactNode }) {
-  const { getActualAppearance } = useAppearance();
   const setFocused = useInputFocus((state) => state.setFocused);
   const [open, setOpen] = useState(false);
+  const [variables, setVariables] = useState<EnvVariable[]>([]);
+  const [isUploading, setIsUploading] = useState(false);
+  const [isPasting, setIsPasting] = useState(false);
+  const [uploadError, setUploadError] = useState<string | null>(null);
+  const fileInputRef = useRef<HTMLInputElement>(null);
+
+  // Find duplicate keys
+  const duplicateKeys = useMemo(() => {
+    const keyCounts = new Map<string, number>();
+    variables.forEach((v) => {
+      const key = v.key.trim();
+      if (key) {
+        keyCounts.set(key, (keyCounts.get(key) || 0) + 1);
+      }
+    });
+    const duplicates = new Set<string>();
+    keyCounts.forEach((count, key) => {
+      if (count > 1) {
+        duplicates.add(key);
+      }
+    });
+    return duplicates;
+  }, [variables]);
+
+  const hasDuplicates = duplicateKeys.size > 0;
+
   const form = useForm<{
-    env: string;
+    variables: Array<{ key: string; value: string; is_secret: boolean }>;
     path: string;
   }>({
-    env: '',
+    variables: [],
     path: site.type_data.env_path || `${site.path}/.env`,
   });
 
@@ -33,15 +71,22 @@ export default function Env({ site, children }: { site: Site; children: ReactNod
 
   const submit = (e: FormEvent) => {
     e.preventDefault();
-    form.put(route('application.update-env', { server: site.server_id, site: site.id }), {
-      onSuccess: () => {
-        handleOpenChange(false);
-      },
-    });
+
+    // Transform variables for submission
+    form.transform(() => ({
+      variables: variables.map((v) => ({
+        key: v.key,
+        value: v.value,
+        is_secret: v.isSecret,
+      })),
+      path: form.data.path,
+    }));
+
+    form.put(route('application.update-env', { server: site.server_id, site: site.id }));
   };
 
   const query = useQuery({
-    queryKey: ['application.env', site.server_id, site.id],
+    queryKey: ['application.env', site.server_id, site.id, form.data.path],
     queryFn: async () => {
       const response = await axios.get(
         route('application.env', {
@@ -50,8 +95,16 @@ export default function Env({ site, children }: { site: Site; children: ReactNod
           env: form.data.path,
         }),
       );
-      if (response.data?.env) {
-        form.setData('env', response.data.env);
+      if (response.data?.variables) {
+        // Use server-parsed variables (with is_secret from backend)
+        // Variables from server are NOT new (isNew = false)
+        const parsed = response.data.variables.map((v: { key: string; value: string; is_secret: boolean }) => ({
+          key: v.key,
+          value: v.value,
+          isSecret: v.is_secret,
+          isNew: false,
+        }));
+        setVariables(parsed);
       }
       return response.data;
     },
@@ -60,52 +113,234 @@ export default function Env({ site, children }: { site: Site; children: ReactNod
     refetchOnWindowFocus: false,
   });
 
-  registerDotEnvLanguage(useMonaco());
+  const handleVariableChange = (index: number, updatedVariable: EnvVariable) => {
+    setVariables((prev) => {
+      const newVariables = [...prev];
+      newVariables[index] = updatedVariable;
+      return newVariables;
+    });
+  };
+
+  const handleVariableDelete = (index: number) => {
+    setVariables((prev) => prev.filter((_, i) => i !== index));
+  };
+
+  const handleAddVariable = () => {
+    const existingKeys = variables.map((v) => v.key);
+    const newKey = generateUniqueKey(existingKeys);
+    setVariables((prev) => [
+      ...prev,
+      {
+        key: newKey,
+        value: '',
+        isSecret: false,
+        isNew: true, // Mark as new so user can toggle secret and see value
+      },
+    ]);
+  };
+
+  const handleFileUpload = async (event: React.ChangeEvent<HTMLInputElement>) => {
+    const file = event.target.files?.[0];
+    if (!file) return;
+
+    const reader = new FileReader();
+    reader.onload = async (e) => {
+      const content = e.target?.result as string;
+      if (content) {
+        setIsUploading(true);
+        setUploadError(null);
+        try {
+          // Send to backend for parsing
+          const response = await axios.post(
+            route('application.parse-env', {
+              server: site.server_id,
+              site: site.id,
+            }),
+            { content },
+          );
+
+          if (response.data?.variables) {
+            // Mark all uploaded variables as new
+            const parsed = response.data.variables.map((v: { key: string; value: string; is_secret: boolean }) => ({
+              key: v.key,
+              value: v.value,
+              isSecret: v.is_secret,
+              isNew: true,
+            }));
+            setVariables(parsed);
+          }
+        } catch (error) {
+          if (axios.isAxiosError(error)) {
+            setUploadError(error.response?.data?.message || 'Failed to parse uploaded file');
+          } else {
+            setUploadError('Failed to parse uploaded file');
+          }
+        } finally {
+          setIsUploading(false);
+        }
+      }
+    };
+    reader.readAsText(file);
+
+    // Reset the input so the same file can be selected again
+    if (fileInputRef.current) {
+      fileInputRef.current.value = '';
+    }
+  };
+
+  const handleUploadClick = () => {
+    fileInputRef.current?.click();
+  };
+
+  const handlePasteFromClipboard = async () => {
+    try {
+      const content = await navigator.clipboard.readText();
+      if (!content.trim()) {
+        setUploadError('Clipboard is empty');
+        return;
+      }
+
+      setIsPasting(true);
+      setUploadError(null);
+
+      const response = await axios.post(
+        route('application.parse-env', {
+          server: site.server_id,
+          site: site.id,
+        }),
+        { content },
+      );
+
+      if (response.data?.variables) {
+        const parsed = response.data.variables.map((v: { key: string; value: string; is_secret: boolean }) => ({
+          key: v.key,
+          value: v.value,
+          isSecret: v.is_secret,
+          isNew: true,
+        }));
+        setVariables(parsed);
+      }
+    } catch (error) {
+      if (axios.isAxiosError(error)) {
+        setUploadError(error.response?.data?.message || 'Failed to parse clipboard content');
+      } else {
+        setUploadError('Failed to read from clipboard');
+      }
+    } finally {
+      setIsPasting(false);
+    }
+  };
 
   return (
     <Sheet open={open} onOpenChange={handleOpenChange}>
       <SheetTrigger asChild>{children}</SheetTrigger>
-      <SheetContent className="sm:max-w-5xl">
+      <SheetContent className="flex flex-col overflow-hidden sm:max-w-4xl">
         <SheetHeader>
-          <SheetTitle className="flex items-center gap-4">
-            <Input
-              name="path"
-              value={form.data.path}
-              onChange={(e) => form.setData('path', e.target.value)}
-              autoFocus={false}
-              className="max-w-[80%]"
-            />
-            <Button variant="outline" size="icon" onClick={() => query.refetch()} disabled={query.isFetching}>
-              <RefreshCwIcon className={query.isFetching ? 'animate-spin' : ''} />
-            </Button>
-          </SheetTitle>
-          <SheetDescription>Site path: {site.path}</SheetDescription>
+          <SheetTitle>Environment Variables</SheetTitle>
+          <SheetDescription>Manage environment variables for your application.</SheetDescription>
         </SheetHeader>
-        <Form id="update-env-form" className="h-full" onSubmit={submit}>
-          {query.isSuccess ? (
-            <Editor
-              value={form.data.env}
-              defaultLanguage="dotenv"
-              theme={getActualAppearance() === 'dark' ? 'vs-dark' : 'vs'}
-              className="h-full"
-              onChange={(value) => form.setData('env', value ?? '')}
-              options={{
-                fontSize: 15,
-              }}
-            />
-          ) : (
-            <Skeleton className="h-full w-full rounded-none" />
-          )}
+        <Form id="update-env-form" className="flex min-h-0 flex-1 flex-col p-4" onSubmit={submit}>
+          <div className="mb-4 flex shrink-0 items-center gap-2">
+            <Input name="path" value={form.data.path} onChange={(e) => form.setData('path', e.target.value)} autoFocus={false} className="flex-1" />
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="icon"
+                  onClick={() => query.refetch()}
+                  disabled={query.isFetching || isUploading || isPasting}
+                >
+                  <RefreshCwIcon className={query.isFetching ? 'animate-spin' : ''} />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>Reload from server</TooltipContent>
+            </Tooltip>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="icon"
+                  onClick={handleUploadClick}
+                  disabled={query.isFetching || isUploading || isPasting}
+                >
+                  {isUploading ? <LoaderCircleIcon className="animate-spin" /> : <UploadIcon />}
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>Upload .env file</TooltipContent>
+            </Tooltip>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="icon"
+                  onClick={handlePasteFromClipboard}
+                  disabled={query.isFetching || isUploading || isPasting}
+                >
+                  {isPasting ? <LoaderCircleIcon className="animate-spin" /> : <ClipboardIcon />}
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>Paste from clipboard</TooltipContent>
+            </Tooltip>
+            <input ref={fileInputRef} type="file" accept="*" onChange={handleFileUpload} className="hidden" />
+          </div>
+          <div className="min-h-0 flex-1 overflow-y-auto">
+            {uploadError && (
+              <Alert variant="destructive" className="mb-4">
+                <AlertCircleIcon className="size-4" />
+                <AlertDescription>{uploadError}</AlertDescription>
+              </Alert>
+            )}
+            {form.errors && Object.keys(form.errors).length > 0 && (
+              <Alert variant="destructive" className="mb-4">
+                <AlertCircleIcon className="size-4" />
+                <AlertDescription>
+                  {Object.values(form.errors).map((error, i) => (
+                    <div key={i}>{error}</div>
+                  ))}
+                </AlertDescription>
+              </Alert>
+            )}
+            {query.isSuccess ? (
+              <div className="space-y-3 py-2">
+                {variables.map((variable, index) => (
+                  <EnvVariableRow
+                    key={`env-${index}`}
+                    variable={variable}
+                    onChange={(updated) => handleVariableChange(index, updated)}
+                    onDelete={() => handleVariableDelete(index)}
+                    error={duplicateKeys.has(variable.key.trim()) ? 'Duplicate key' : undefined}
+                  />
+                ))}
+                <Button type="button" variant="outline" className="w-full" onClick={handleAddVariable}>
+                  <PlusIcon className="mr-2 size-4" />
+                  Add Variable
+                </Button>
+              </div>
+            ) : (
+              <div className="space-y-3 py-2">
+                {[...Array(5)].map((_, i) => (
+                  <div key={i} className="flex gap-2">
+                    <Skeleton className="h-9 w-48" />
+                    <Skeleton className="h-9 flex-1" />
+                    <Skeleton className="size-9" />
+                  </div>
+                ))}
+              </div>
+            )}
+          </div>
         </Form>
-        <SheetFooter>
+        <SheetFooter className="shrink-0">
           <div className="flex items-center gap-2">
-            <Button form="update-env-form" disabled={form.processing || query.isLoading} onClick={submit} className="ml-2">
-              {(form.processing || query.isLoading) && <LoaderCircleIcon className="animate-spin" />}
-              Save
-            </Button>
             <SheetClose asChild>
               <Button variant="outline">Cancel</Button>
             </SheetClose>
+            <Button form="update-env-form" disabled={form.processing || query.isLoading || hasDuplicates} onClick={submit}>
+              {(form.processing || query.isLoading) && <LoaderCircleIcon className="animate-spin" />}
+              Save
+            </Button>
           </div>
         </SheetFooter>
       </SheetContent>
diff --git a/resources/js/types/env.d.ts b/resources/js/types/env.d.ts
new file mode 100644
index 000000000..3aac3aab8
--- /dev/null
+++ b/resources/js/types/env.d.ts
@@ -0,0 +1,6 @@
+export interface EnvVariable {
+  key: string;
+  value: string;
+  isSecret: boolean;
+  isNew?: boolean; // True for variables being created in this session
+}
diff --git a/resources/views/ssh/os/install-dependencies.blade.php b/resources/views/ssh/os/install-dependencies.blade.php
index 6c9b685b5..5ebbf869f 100755
--- a/resources/views/ssh/os/install-dependencies.blade.php
+++ b/resources/views/ssh/os/install-dependencies.blade.php
@@ -5,6 +5,6 @@
 # Install Mise
 sudo install -dm 755 /etc/apt/keyrings
 curl -fsSL https://mise.jdx.dev/gpg-key.pub | sudo tee /etc/apt/keyrings/mise-archive-keyring.pub 1> /dev/null
-echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=amd64] https://mise.jdx.dev/deb stable main" | sudo tee /etc/apt/sources.list.d/mise.list
+echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(dpkg --print-architecture)] https://mise.jdx.dev/deb stable main" | sudo tee /etc/apt/sources.list.d/mise.list
 sudo apt update
 sudo apt install -y mise
diff --git a/tests/Feature/API/SitesTest.php b/tests/Feature/API/SitesTest.php
index d3070e572..c01591bfd 100644
--- a/tests/Feature/API/SitesTest.php
+++ b/tests/Feature/API/SitesTest.php
@@ -374,6 +374,9 @@ public function test_show_env(): void
             ->assertJsonStructure([
                 'data' => [
                     'env',
+                    'variables' => [
+                        '*' => ['key', 'value', 'is_secret'],
+                    ],
                 ],
             ])
             ->assertJsonFragment([
diff --git a/tests/Feature/ApplicationTest.php b/tests/Feature/ApplicationTest.php
index e3e5f1cba..4b001ab51 100644
--- a/tests/Feature/ApplicationTest.php
+++ b/tests/Feature/ApplicationTest.php
@@ -332,6 +332,157 @@ public function test_update_env_file_with_path(): void
         $this->assertEquals('/home/vito/some-path/.env', data_get($this->site->type_data, 'env_path'));
     }
 
+    public function test_update_env_file_with_variables(): void
+    {
+        SSH::fake();
+
+        $this->actingAs($this->user);
+
+        $this->put(route('application.update-env', [
+            'server' => $this->server,
+            'site' => $this->site,
+        ]), [
+            'variables' => [
+                ['key' => 'APP_ENV', 'value' => 'production'],
+                ['key' => 'APP_DEBUG', 'value' => 'false'],
+                ['key' => 'DB_PASSWORD', 'value' => 'secret123'],
+            ],
+        ])
+            ->assertSessionDoesntHaveErrors();
+
+        $this->site->refresh();
+
+        $this->assertEquals($this->site->path.'/.env', data_get($this->site->type_data, 'env_path'));
+    }
+
+    public function test_get_env_returns_variables(): void
+    {
+        SSH::fake('APP_NAME=TestApp'.PHP_EOL.'DB_PASSWORD=secret');
+
+        $this->actingAs($this->user);
+
+        $response = $this->get(route('application.env', [
+            'server' => $this->server,
+            'site' => $this->site,
+        ]));
+
+        $response->assertOk();
+        $response->assertJsonStructure([
+            'env',
+            'variables' => [
+                '*' => ['key', 'value', 'is_secret'],
+            ],
+        ]);
+    }
+
+    public function test_secret_values_are_masked_when_stored_in_db(): void
+    {
+        SSH::fake();
+
+        $this->actingAs($this->user);
+
+        // First, save some variables with secrets
+        $this->put(route('application.update-env', [
+            'server' => $this->server,
+            'site' => $this->site,
+        ]), [
+            'variables' => [
+                ['key' => 'APP_NAME', 'value' => 'TestApp', 'is_secret' => false],
+                ['key' => 'DB_PASSWORD', 'value' => 'supersecret123', 'is_secret' => true],
+            ],
+        ])->assertSessionDoesntHaveErrors();
+
+        $this->site->refresh();
+
+        // Verify stored in DB
+        $this->assertNotNull($this->site->env_variables);
+        $this->assertCount(2, $this->site->env_variables);
+
+        // Now fetch the variables - secrets should be masked
+        $response = $this->get(route('application.env', [
+            'server' => $this->server,
+            'site' => $this->site,
+        ]));
+
+        $response->assertOk();
+        $data = $response->json('variables');
+
+        // Find the secret variable
+        $secretVar = collect($data)->firstWhere('key', 'DB_PASSWORD');
+        $this->assertTrue($secretVar['is_secret']);
+        $this->assertEquals('', $secretVar['value']); // Value should be empty/masked
+
+        // Non-secret should have value
+        $normalVar = collect($data)->firstWhere('key', 'APP_NAME');
+        $this->assertFalse($normalVar['is_secret']);
+        $this->assertEquals('TestApp', $normalVar['value']);
+    }
+
+    public function test_secret_values_preserved_when_updating_with_empty_value(): void
+    {
+        SSH::fake();
+
+        $this->actingAs($this->user);
+
+        // First, save variables with secrets
+        $this->put(route('application.update-env', [
+            'server' => $this->server,
+            'site' => $this->site,
+        ]), [
+            'variables' => [
+                ['key' => 'DB_PASSWORD', 'value' => 'original_secret', 'is_secret' => true],
+            ],
+        ])->assertSessionDoesntHaveErrors();
+
+        // Now update with empty value for the secret (simulating frontend behavior)
+        $this->put(route('application.update-env', [
+            'server' => $this->server,
+            'site' => $this->site,
+        ]), [
+            'variables' => [
+                ['key' => 'DB_PASSWORD', 'value' => '', 'is_secret' => true],
+            ],
+        ])->assertSessionDoesntHaveErrors();
+
+        $this->site->refresh();
+
+        // The original secret value should be preserved
+        $storedVar = collect($this->site->env_variables)->firstWhere('key', 'DB_PASSWORD');
+        $this->assertEquals('original_secret', $storedVar['value']);
+    }
+
+    public function test_parse_env_endpoint(): void
+    {
+        $this->actingAs($this->user);
+
+        $envContent = "APP_NAME=TestApp\nDB_PASSWORD=secret123\nAPP_DEBUG=true";
+
+        $response = $this->post(route('application.parse-env', [
+            'server' => $this->server,
+            'site' => $this->site,
+        ]), [
+            'content' => $envContent,
+        ]);
+
+        $response->assertOk();
+        $response->assertJsonStructure([
+            'variables' => [
+                '*' => ['key', 'value', 'is_secret'],
+            ],
+        ]);
+
+        $variables = $response->json('variables');
+        $this->assertCount(3, $variables);
+
+        // Check that DB_PASSWORD is detected as secret
+        $passwordVar = collect($variables)->firstWhere('key', 'DB_PASSWORD');
+        $this->assertTrue($passwordVar['is_secret']);
+
+        // Check that APP_NAME is not secret
+        $nameVar = collect($variables)->firstWhere('key', 'APP_NAME');
+        $this->assertFalse($nameVar['is_secret']);
+    }
+
     /**
      * @param  array<string, mixed>  $webhook
      * @param  array<string, mixed>  $payload
diff --git a/tests/Unit/EnvParserTest.php b/tests/Unit/EnvParserTest.php
new file mode 100644
index 000000000..b7fa9be01
--- /dev/null
+++ b/tests/Unit/EnvParserTest.php
@@ -0,0 +1,221 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Helpers\EnvParser;
+use PHPUnit\Framework\TestCase;
+
+class EnvParserTest extends TestCase
+{
+    public function test_parse_simple_env(): void
+    {
+        $raw = "APP_NAME=Laravel\nAPP_ENV=production";
+        $result = EnvParser::parse($raw);
+
+        $this->assertCount(2, $result);
+        $this->assertEquals('APP_NAME', $result[0]['key']);
+        $this->assertEquals('Laravel', $result[0]['value']);
+        $this->assertFalse($result[0]['is_secret']);
+        $this->assertEquals('APP_ENV', $result[1]['key']);
+        $this->assertEquals('production', $result[1]['value']);
+    }
+
+    public function test_parse_quoted_values(): void
+    {
+        $raw = 'APP_NAME="My Laravel App"';
+        $result = EnvParser::parse($raw);
+
+        $this->assertCount(1, $result);
+        $this->assertEquals('My Laravel App', $result[0]['value']);
+    }
+
+    public function test_parse_single_quoted_values(): void
+    {
+        $raw = "APP_NAME='My Laravel App'";
+        $result = EnvParser::parse($raw);
+
+        $this->assertCount(1, $result);
+        $this->assertEquals('My Laravel App', $result[0]['value']);
+    }
+
+    public function test_parse_skips_comments(): void
+    {
+        $raw = "# This is a comment\nAPP_NAME=Laravel\n# Another comment";
+        $result = EnvParser::parse($raw);
+
+        $this->assertCount(1, $result);
+        $this->assertEquals('APP_NAME', $result[0]['key']);
+    }
+
+    public function test_parse_skips_empty_lines(): void
+    {
+        $raw = "APP_NAME=Laravel\n\n\nAPP_ENV=production";
+        $result = EnvParser::parse($raw);
+
+        $this->assertCount(2, $result);
+    }
+
+    public function test_parse_handles_value_with_equals(): void
+    {
+        $raw = 'APP_KEY=base64:abc=123=def=';
+        $result = EnvParser::parse($raw);
+
+        $this->assertCount(1, $result);
+        $this->assertEquals('base64:abc=123=def=', $result[0]['value']);
+    }
+
+    public function test_is_secret_key_detects_password(): void
+    {
+        $raw = 'DB_PASSWORD=secret123';
+        $result = EnvParser::parse($raw);
+
+        $this->assertTrue($result[0]['is_secret']);
+    }
+
+    public function test_is_secret_key_detects_secret(): void
+    {
+        $raw = 'APP_SECRET=abc123';
+        $result = EnvParser::parse($raw);
+
+        $this->assertTrue($result[0]['is_secret']);
+    }
+
+    public function test_is_secret_key_detects_token(): void
+    {
+        $raw = 'API_TOKEN=xyz789';
+        $result = EnvParser::parse($raw);
+
+        $this->assertTrue($result[0]['is_secret']);
+    }
+
+    public function test_is_secret_key_detects_key(): void
+    {
+        $raw = 'APP_KEY=base64:abc123';
+        $result = EnvParser::parse($raw);
+
+        $this->assertTrue($result[0]['is_secret']);
+    }
+
+    public function test_is_secret_key_detects_private(): void
+    {
+        $raw = 'PRIVATE_KEY=-----BEGIN RSA-----';
+        $result = EnvParser::parse($raw);
+
+        $this->assertTrue($result[0]['is_secret']);
+    }
+
+    public function test_stringify_simple_variables(): void
+    {
+        $variables = [
+            ['key' => 'APP_NAME', 'value' => 'Laravel'],
+            ['key' => 'APP_ENV', 'value' => 'production'],
+        ];
+        $result = EnvParser::stringify($variables);
+
+        $this->assertEquals("APP_NAME=Laravel\nAPP_ENV=production", $result);
+    }
+
+    public function test_stringify_quotes_values_with_spaces(): void
+    {
+        $variables = [
+            ['key' => 'APP_NAME', 'value' => 'My Laravel App'],
+        ];
+        $result = EnvParser::stringify($variables);
+
+        $this->assertEquals('APP_NAME="My Laravel App"', $result);
+    }
+
+    public function test_stringify_quotes_values_with_newlines(): void
+    {
+        $variables = [
+            ['key' => 'MULTILINE', 'value' => "line1\nline2"],
+        ];
+        $result = EnvParser::stringify($variables);
+
+        $this->assertEquals('MULTILINE="line1\nline2"', $result);
+    }
+
+    public function test_stringify_skips_empty_keys(): void
+    {
+        $variables = [
+            ['key' => '', 'value' => 'empty'],
+            ['key' => 'APP_NAME', 'value' => 'Laravel'],
+        ];
+        $result = EnvParser::stringify($variables);
+
+        $this->assertEquals('APP_NAME=Laravel', $result);
+    }
+
+    public function test_roundtrip_preserves_data(): void
+    {
+        $original = "APP_NAME=Laravel\nDB_PASSWORD=secret123\nAPP_KEY=base64:abc=123=";
+        $parsed = EnvParser::parse($original);
+        $stringified = EnvParser::stringify($parsed);
+        $reParsed = EnvParser::parse($stringified);
+
+        $this->assertCount(count($parsed), $reParsed);
+        foreach ($parsed as $i => $var) {
+            $this->assertEquals($var['key'], $reParsed[$i]['key']);
+            $this->assertEquals($var['value'], $reParsed[$i]['value']);
+        }
+    }
+
+    public function test_mask_secrets_hides_secret_values(): void
+    {
+        $variables = [
+            ['key' => 'APP_NAME', 'value' => 'Laravel', 'is_secret' => false],
+            ['key' => 'DB_PASSWORD', 'value' => 'supersecret', 'is_secret' => true],
+            ['key' => 'API_TOKEN', 'value' => 'token123', 'is_secret' => true],
+        ];
+
+        $masked = EnvParser::maskSecrets($variables);
+
+        $this->assertEquals('Laravel', $masked[0]['value']);
+        $this->assertEquals('', $masked[1]['value']);
+        $this->assertEquals('', $masked[2]['value']);
+    }
+
+    public function test_merge_with_stored_preserves_empty_secret_values(): void
+    {
+        $stored = [
+            ['key' => 'DB_PASSWORD', 'value' => 'original_secret', 'is_secret' => true],
+            ['key' => 'APP_NAME', 'value' => 'Laravel', 'is_secret' => false],
+        ];
+
+        $incoming = [
+            ['key' => 'DB_PASSWORD', 'value' => '', 'is_secret' => true], // Empty = keep stored
+            ['key' => 'APP_NAME', 'value' => 'NewName', 'is_secret' => false],
+        ];
+
+        $merged = EnvParser::mergeWithStored($incoming, $stored);
+
+        $this->assertEquals('original_secret', $merged[0]['value']);
+        $this->assertEquals('NewName', $merged[1]['value']);
+    }
+
+    public function test_merge_with_stored_allows_updating_secret_values(): void
+    {
+        $stored = [
+            ['key' => 'DB_PASSWORD', 'value' => 'original_secret', 'is_secret' => true],
+        ];
+
+        $incoming = [
+            ['key' => 'DB_PASSWORD', 'value' => 'new_secret', 'is_secret' => true], // New value provided
+        ];
+
+        $merged = EnvParser::mergeWithStored($incoming, $stored);
+
+        $this->assertEquals('new_secret', $merged[0]['value']);
+    }
+
+    public function test_merge_with_null_stored_returns_incoming(): void
+    {
+        $incoming = [
+            ['key' => 'APP_NAME', 'value' => 'Laravel', 'is_secret' => false],
+        ];
+
+        $merged = EnvParser::mergeWithStored($incoming, null);
+
+        $this->assertEquals($incoming, $merged);
+    }
+}