n8n Workflow Inspector

Check an n8n workflow before you share, sell or import it. Paste the workflow JSON and get a plain report of its triggers, services, credentials and nodes, with warnings for hardcoded API keys, pinned test data, webhook ids, disconnected and legacy nodes. Then copy a sanitised version that is safe to post, or a Mermaid diagram for your docs.

Everything runs in your browser. Your workflow never leaves this device.

Paste a workflow export or nodes copied from the n8n canvas, or drop a .json file here.

Processed on this device only

Your report will appear here

Paste or upload a workflow, or press Try a sample to see what the inspector checks.

How to check an n8n workflow

  1. 1. Paste or upload

    In n8n, select all nodes and copy (Ctrl/Cmd+C), or use Download from the workflow menu. Paste the JSON here or drop the .json file on the box.

  2. 2. Review the report

    See triggers, connected services, credentials and every node, plus warnings sorted from high to low: hardcoded keys, pinned data, disconnected or legacy nodes.

  3. 3. Share a clean copy

    Pick what to strip, then copy or download the sanitised JSON, or copy a Mermaid diagram of the flow for your README or docs.

Looking for a starting point? Browse the n8n workflow library. If your JSON will not parse, tidy it with the JSON Formatter or find the error with the JSON Validator. Replacing an old Cron node? Build the schedule with the Cron Expression Generator.

Frequently asked questions

Is my workflow uploaded anywhere?

No. The inspector runs entirely in your browser with JavaScript. The JSON you paste or the file you choose is read on your device and is never sent to AltFTool or anyone else. You can disconnect from the internet after the page loads and it keeps working.

What kind of secrets can the inspector find?

It scans every node parameter for common key formats (OpenAI and Anthropic sk- keys, Stripe, AWS access keys, GitHub and Slack tokens, Google API keys, Telegram bot tokens, JWTs, private keys), Bearer tokens, keys in URL query strings, and long random values in fields or headers named key, token, secret, password or authorization. n8n expressions such as {{ $env.API_KEY }} are not flagged. Pattern matching cannot catch everything, so still read the JSON before publishing it.

What does the sanitised JSON remove?

By default it clears pinned test data, removes credential ids (keeping the credential name so n8n can remap it), removes webhook ids and resets UUID webhook paths, drops instance metadata such as meta.instanceId, the workflow id and versionId, sets active to false, and replaces detected secrets with REDACTED. Each option can be switched off.

Will the sanitised workflow still import into n8n?

Yes. The nodes, parameters and connections stay the same, so you can paste it onto a canvas or import the file as usual. After importing, pick or create the credentials for each node, set a webhook path if one was reset, and put any redacted keys into an n8n credential instead of a parameter.

Why are some nodes marked as outdated?

Older workflows can use nodes n8n has since replaced, for example Function and Function Item (now the Code node), Cron and Interval (now Schedule Trigger) or Start (now Manual Trigger). They usually still run, but the newer nodes get fixes and features, so the inspector suggests the replacement.

Related tools

n8n is a trademark of n8n GmbH. AltFTool is not affiliated with, endorsed by or sponsored by n8n. Community templates are credited to their creators and link to the original listing; AltFTool originals are written and tested by the AltFTool team.