Bash Linter — Lint Shell Scripts Online

Lint Bash and sh scripts in your browser. Bash Checker covers the same class of issues a local bash linter like ShellCheck catches, plus security and quality dimensions a pattern-based linter cannot reason about.

Worked example: a script before and after linting

#!/usr/bin/env bash
set -e
name=$1
if [ $name = "root" ]; then
  echo "Running as root"
fi
rm -rf /tmp/$name

What a bash linter checks

A bash linter looks for code patterns that are syntactically valid but almost always wrong: unquoted variables that will word-split, undefined variables, missing shebangs, fragile globbing, use of `=` vs `==` in tests, and several hundred ShellCheck-style rules. This linter runs all of those plus security scanning (curl | bash, command injection, hardcoded secrets) in a single pass.

Lint without installing anything

Local linters (ShellCheck, shfmt) require a package manager or a Haskell runtime. This online linter skips that — paste the script, get the report. Useful when reviewing scripts from gists, CI logs, Docker images, or Stack Overflow answers without setting up tooling.

Severity-graded output

Every finding has a severity (info/low/medium/high) and a line number. Sort by severity to triage a long report, or filter to only show high-impact issues. Each finding includes a suggested fix and, where useful, a corrected code snippet.

The ten lint findings that matter most

In practice a handful of patterns account for most real breakage: unquoted expansions that word-split on spaces (SC2086), unquoted command substitution (SC2046), `cd` without `|| exit` so the script keeps running in the wrong directory (SC2164), `local var=$(cmd)` masking the command exit code (SC2155), testing `$?` instead of the command itself (SC2181), parsing `ls` output in a `for` loop (SC2045), `rm -rf "$dir/"` where `$dir` can be empty (SC2115), missing `set -euo pipefail`, `[ ]` string comparison with `==` in a POSIX script, and reading a file with `for line in $(cat f)` instead of `while IFS= read -r`. The linter reports each with the offending line and a corrected snippet.

Linting sh, bash, and CI scripts

The shebang drives the rule set. A `#!/bin/sh` script is linted for POSIX portability, so arrays, `[[ ]]`, `local`, and process substitution surface as portability findings. A `#!/usr/bin/env bash` script is linted against Bash semantics and those constructs are fine. Inline scripts pulled out of GitHub Actions `run:` blocks, Dockerfile `RUN` lines, or systemd `ExecStart=` wrappers can be pasted directly — just include the shebang you intend to run under so the portability findings are accurate.

Bash linter comparison: online vs ShellCheck vs bash -n

bash -n catches syntax errors only and misses logic bugs. ShellCheck is the gold-standard local linter for pattern-based issues and CI integration. This online bash linter covers the same ShellCheck-style patterns plus security, error-handling, and intent analysis — best for interactive review when you cannot install tooling or need a second opinion beyond pure pattern matching.

Lint output you can act on in a review

Findings are grouped by category and severity, each with a line number, an explanation of the failure mode, and a suggested fix. Nothing is applied to your script automatically. Export the report as Markdown to paste into a pull-request comment, or as JSON if you want to feed it into a dashboard. Re-linting the same script returns instantly from the browser cache, so iterating on fixes is cheap.

Frequently asked questions

Does the linter modify my script?
No. Findings and suggested patches are read-only — you copy a fix in manually if you want it.
Can I lint a script pulled from a Dockerfile or CI job?
Yes. Paste the shell body with the shebang you intend it to run under so portability findings match the real interpreter.
Does it lint scripts that source other files?
It lints the pasted text only. Behaviour that depends on a sourced file is reported as unverifiable rather than assumed.
Is this an alternative to ShellCheck?
Yes — it covers the same class of bug patterns plus security and quality dimensions ShellCheck does not flag. For CI use ShellCheck (faster, deterministic). For interactive review use this.
Can it lint sh and POSIX scripts?
Yes. Bash-only features get flagged in the portability section when the script targets /bin/sh.
How long does a lint take?
Typical scripts complete in 90–120 seconds. Repeated lints of the same script return instantly from the browser cache.