Loading page
About this tool
Reads an .xlsx package in your browser and reports the source rows still stored inside its pivot caches, plus connection strings and Power Query source paths. Nothing uploads.
The Excel Pivot Cache Leak Finder opens an .xlsx package in your browser and counts the source rows still stored inside its pivot caches — the verbatim copy of the source data that ECMA-376 (ISO/IEC 29500-1) keeps in xl/pivotCache/pivotCacheRecords*.xml, which survives even after the source worksheet is deleted. It is for anyone about to send a workbook outside their organisation: finance and HR teams shipping a summary built from a salary sheet, analysts forwarding a deck built from a customer extract, and security reviewers checking outbound files. It also lists the field names, previews the recoverable rows, says whether a matching source sheet still exists, and reads the connection strings in xl/connections.xml and the Power Query source paths inside the DataMashup part described by [MS-QDEFF] section 2.1. Nothing is uploaded — the file is read with the browser File API in the tab you have open.
Open Excel Pivot Cache Leak Finder on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Every r element in pivotCacheRecords is one source row (ECMA-376 clause 18.10.1.75); the tool counts all of them and shows the file's own declared count beside it.
Each cache's worksheetSource sheet name is compared with the sheets listed in xl/workbook.xml, so a cache with no surviving source is named as such.
Pivot cache records, connection strings in xl/connections.xml, and Power Query source paths in the DataMashup part are all reported from the same package.
The workbook is read into memory with the File API and parsed in the tab. No upload, no server, no logging — you can verify it with the browser network panel open.
Yes, in almost every case. Deleting the sheet removes it from xl/workbook.xml, but the pivot table's cached copy lives in a separate package part, xl/pivotCache/pivotCacheRecords1.xml, and is untouched. ECMA-376 clause 18.10.1.67 gives pivotCacheDefinition a saveData attribute that defaults to true, meaning the rows are written into the file. This tool counts those r elements and shows a preview of them.
The rule that controls it is the saveData attribute on pivotCacheDefinition (ECMA-376 clause 18.10.1.67). When saveData is false, no pivotCacheRecords rows are written into the package and the pivot rebuilds only on refresh. In Excel this switch appears as the PivotTable Options setting "Save source data with file". This page reports the current value per cache; it does not change your file.
The dbPr element (ECMA-376 clause 18.13.1.5) stores the full OLE DB or ODBC string in its connection attribute and the query text in its command attribute. A typical string names the host (Data Source), the database (Initial Catalog), the account (User ID) and sometimes a Password or token value. This page lists those keywords and masks any secret value on screen, while telling you it is present in the file.
In a custom XML part holding a base64 DataMashup payload. Its layout is [MS-QDEFF] section 2.1: a 4-byte version, a 4-byte package length, then a ZIP containing Formulas/Section1.m. That M document holds the literal arguments passed to data-access functions such as Sql.Database, Folder.Files and Web.Contents, so internal hostnames, UNC shares and API URLs sit in the file as plain text. This tool lists each connector and the literal location beside it.