confbox vs dotenv: 0.062 ms vs 0.026 ms on 50 Keys

I parsed the same 50-key KEY=VALUE blob on this box: dotenv 18.0.5 took about 0.026 ms with the default parser (about 0.010 ms with fast: true), while confbox 0.3.1 parseINI took about 0.062 ms. confbox's tree-shaken INI entry gzipped to 1,537 B against dotenv's 4,938 B, and confbox parseTOML on a small typed config was about 0.0047 ms.

Short answer: keep dotenv when you want .env files injected into process.env. Reach for confbox when you load TOML, YAML, JSONC, JSON5 or INI as plain objects without touching the environment, especially if you only import the one format you need. No affiliate links in this post.

What I tested

• Machine: 8 vCPU Intel Xeon / 15 GB RAM shared Linux cloud box, tested 6 Oct 2026 about 03:45 IST.
• Versions: confbox 0.3.1, dotenv 18.0.5 (both npm latest that day), Node 20.19.2, esbuild 0.28.2 node ESM minify + gzip -9.
• Inputs: a 50-key .env-style string (1,640 B) and a 500-key string (20,280 B); a small TOML/YAML/JSON5/JSONC/JSON config with nested tables; dotenv.config against a real fixture/.env file versus parseTOML on fixture/config.toml. Median of 9 rounds × 2,000 ops, two processes with the library order reversed. Scripts and JSON in /workspace/bench-confbox-dotenv/.
• Behavior checks: quotes, empty values, equals inside values, unexpanded dollar HOST references, type differences (string vs number/bool), whether config() mutates process.env, and TOML round-trip.
• Not tested: dotenv expand / variable interpolation packages, multiline values beyond escaped newlines, browser runtimes, Bun/Deno hosts, c12 as a full config loader on top of confbox, and adversarial multi-megabyte files.

How fast is confbox vs dotenv?

Job (median ms/op, avg of 2 order-reversed runs)	dotenv 18.0.5	confbox 0.3.1
50-key KEY=VALUE parse	0.0262	0.0617 (parseINI)
50-key with fast: true	0.0098	—
500-key KEY=VALUE parse	0.2377	0.6522 (parseINI)
500-key with fast: true	0.1059	—
Small TOML config	—	0.0047
Small YAML config	—	0.0554
Small JSON5 / JSONC / JSON	—	0.0247 / 0.0069 / 0.0014
dotenv.config file / parseTOML file	0.1037	0.0093

On plain .env text, dotenv wins: about 2.4× faster than parseINI at 50 keys, and its fast scanner is another 2–3× on top. Once the config is structured TOML, confbox is in a different league (about 0.005 ms) and still faster than dotenv.config's file read+parse path here. If you already compared TOML parsers, confbox ships smol-toml under the hood — see smol-toml vs @iarna/toml. YAML cost lines up with the wider yaml vs js-yaml tradeoff.

What does each one cost to install and bundle?

Build (esbuild minify + gzip -9)	Minified	gzip	Inputs
dotenv (parse + config)	11,431 B	4,938 B	2
confbox/ini only	3,194 B	1,537 B	6
confbox/toml only	13,409 B	5,108 B	5
confbox/yaml only	57,939 B	17,608 B	5
confbox/json5 only	29,438 B	8,775 B	6
confbox full export	102,321 B	31,519 B	16

Fresh install: dotenv about 84 KB on disk (1 package), confbox about 232 KB (1 package, formats vendored into dist). Tree-shaking matters: import from confbox/ini and you beat dotenv on gzip; import the whole barrel and you do not. Lock the chosen entry in CI with size-limit vs bundlesize. Parsed objects often get merged with defaults next — that path is measured in defu vs lodash.merge.

Do they return the same shape?

Check	dotenv 18.0.5	confbox 0.3.1
50 KEY=VALUE keys parsed	54 (incl. quotes / empty)	54 via parseINI
QUOTE=hello world	string hello world	string hello world
HAS_EQ=a=b=c	a=b=c	a=b=c
EXPAND references HOST	left as literal dollar HOST	left as literal (INI)
PORT=3000 / DEBUG=true types	always strings	TOML: number / boolean
config() / parse side effects	writes process.env	pure parse, no env writes
Formats in one package	.env only	INI, TOML, YAML, JSON, JSON5, JSONC

dotenv is an env injector that also exposes parse(). confbox is a format toolbox: same INI keys as dotenv on my fixture, but TOML/YAML give real types and nested tables. For loose JSON-ish strings that are not .env files, destr vs superjson is the closer sibling. Path joins around config files are covered in pathe vs node:path.

Which one should you pick?

Situation	My pick
Twelve-factor .env into process.env	dotenv
Hot parse of large .env text	dotenv with fast: true
App config as TOML or YAML with types	confbox (toml or yaml entry)
Smallest bundle for KEY=VALUE only	confbox/ini
Need every format in one dependency	confbox (import only what you use)
Full layered config loader (rc files, overrides)	c12 on top of confbox, not dotenv alone

Bottom line: on this box dotenv 18.0.5 parsed 50 .env keys in about 0.026 ms (0.010 ms fast) versus confbox parseINI at about 0.062 ms, while confbox/ini was the smaller gzip (1.5 KB vs 4.9 KB) and confbox TOML handled typed config in about 0.005 ms without touching process.env. Who should not switch off dotenv: services that rely on config() mutating the environment early in boot. Who should not force .env for everything: tools that already speak TOML/YAML and want typed nested config.

How this was made: I installed both packages on the ShopperCove box, timed parse paths over 2,000 ops × 9 rounds in two order-reversed processes, bundled dotenv and each confbox entry with esbuild, and checked quoting, types, env mutation and TOML round-trips. The JSON results sit next to the scripts. The write-up was drafted with AI help and checked against that output.

Sources

• https://github.com/unjs/confbox
• https://github.com/motdotla/dotenv
• https://www.npmjs.com/package/confbox
• https://www.npmjs.com/package/dotenv
• https://toml.io/
• https://esbuild.github.io/

Related

• https://www.shoppercove.com/blog/smol-toml-vs-iarna-toml
• https://www.shoppercove.com/blog/yaml-vs-js-yaml
• https://www.shoppercove.com/blog/destr-vs-superjson
• https://www.shoppercove.com/blog/defu-vs-lodash-merge
• https://www.shoppercove.com/blog/size-limit-vs-bundlesize
• https://www.shoppercove.com/blog/pathe-vs-node-path
• https://www.shoppercove.com/blog/ohash-vs-object-hash
• https://www.shoppercove.com/blog/knip-vs-depcheck