n8n Workflow JSON Sanitiser

What this tool does

Exporting an n8n workflow to share in a forum thread, a client handover or a public template is one of the easiest ways to leak a credential. The export contains every node parameter exactly as you typed it, and people routinely type API keys straight into an HTTP Request header rather than into a credential.

Paste the JSON here and the sanitiser walks every node, every parameter and every nested object looking for two classes of problem: keys whose name suggests a secret (api_key, authorization, client_secret, signing_secret, webhook_url and similar), and values whose shape matches a known credential format. It replaces each one with a placeholder and lists what it changed, so you can check nothing legitimate was caught.

A worked example

Take an export with an HTTP Request node carrying Authorization: Bearer sk-liveKeyGoesHere, a Slack node with an xoxb- token, and a Webhook node whose production URL includes your instance's hostname and path.

The sanitiser returns the same workflow with those three values replaced by <REDACTED>, a summary listing the node name and parameter path for each hit, and a count. The result is still valid JSON and still imports into n8n — you simply reconnect credentials on the other side, which is what you should have been doing anyway.

Value patterns it recognises

Name-based detection catches the rest, including bespoke internal keys that match no public prefix.

Where people go wrong

Believing that n8n credentials never appear in the export. The credential values do not, but the credential id and name do, and so does anything you typed directly into a node parameter instead of a credential. That second category is where nearly every real leak comes from.

Sharing the production webhook URL. An n8n production webhook path is effectively a bearer token: anyone who has it can fire your workflow. Treat it as a secret, and if one escapes, regenerate the path rather than hoping nobody noticed.

Redacting by hand with find-and-replace. It works until the same key appears in a second node under a different parameter name, which is exactly the case a manual pass misses.

Assuming a rotated key makes the old export safe. It does, but only once the rotation has actually happened. Rotate first, share second.

FAQ

Does anything get uploaded?

No. The parse, the scan and the redaction all happen in your browser. That is the whole point — a tool that asked you to upload a file full of live credentials in order to find the credentials would be self-defeating.

Will the sanitised workflow still import into n8n?

Yes. Only string values are replaced, so the JSON structure, node types, connections and positions are untouched. On import you attach credentials as normal.

Does it work with Make.com blueprints?

Yes, for the same reasons — a Make blueprint is JSON with nested parameters, and the same name and value heuristics apply. Node-specific structure is not interpreted, so the output is a redacted blueprint rather than a rewritten one.

What if it redacts something that is not a secret?

The change list shows every path it touched, so you can spot a false positive and put the value back. Redaction errs on the cautious side deliberately: a wrongly redacted field costs you thirty seconds, a missed key costs you a rotation.

Should I still rotate the key?

If the export has already been shared anywhere — a support ticket, a Slack channel, a Git commit — yes. Sanitising the file afterwards does not un-share what went out.

Next steps

If you are self-hosting and want credentials kept out of workflow JSON in the first place, the n8n Self-Hosted Setup Guide covers environment variables and credential storage, and the n8n Webhook Tutorial explains how production webhook paths are generated. When you need to rebuild a request cleanly rather than clean up an old one, the cURL to n8n converter produces a node with the auth left as a placeholder.

For the official position on deployment and where configuration lives, see the n8n deployment guide and the n8n self-hosting documentation.

Handing a workflow over to a client and want it audited first? Book a discovery call.