Free tool · no sign up
Scan your n8n workflow for leaked keys and personal data.
Paste an n8n workflow, a .env file, an HTTP request or an AI prompt. The scanner finds API keys, credentials and personal data, shows where each one is, and fixes leaky n8n workflows for you.
Your workflow never leaves your browser.
Scan an n8n workflow for secrets, and detect API keys in JSON.
Every check runs on your device with known key formats, Shannon entropy for random looking values, and checksums for card numbers and IBANs.
n8n credential leaks
Keys typed into HTTP Request headers, query parameters and URLs, decrypted credential exports, and N8N_ENCRYPTION_KEY.
Open webhooks
Webhook nodes with Authentication set to None, which anyone with the URL can trigger.
Pinned test data
Real customer emails, cards and phone numbers saved as pinned data, which travels with every export.
API keys in JSON
AWS, OpenAI, Anthropic, Stripe, GitHub, Slack and Google key formats, JWTs, private keys and bearer tokens.
Personal data in AI prompts
Personal data (also called PII, for personally identifiable information): email addresses, phone numbers, card numbers, international bank account numbers (IBANs) and US Social Security numbers.
Code node secrets
Keys pasted into Code nodes, flagged with step by step instructions to move them out.
How an n8n credential leak happens.
A key pasted into an HTTP Request header works, so it stays. Then the workflow is exported for a teammate, shared as a template, committed to Git or pasted into a forum post, and the key goes with it. Pinned test data does the same with real customer details.
A personal data scanner for AI prompts.
Before you send a ticket, an email thread or a log to an AI model, paste it here to see the personal data and keys it carries. To mask them automatically in your workflows, use the Vrymdor™ AI Node.
Questions
- Is my workflow uploaded anywhere?
- No. The scanner is JavaScript that runs on this page. What you paste or drop is read by your browser and never sent to a server, stored or logged. Once the page has loaded you can turn off your network and it still works.
- What does it detect?
- Known key formats (AWS, OpenAI, Anthropic, Stripe, GitHub, Slack, Google), JSON Web Tokens, private keys, bearer and basic auth tokens, passwords in connection URLs, long random strings next to words like key or token, email addresses, phone numbers, card numbers that pass the Luhn check, IBANs that pass the mod 97 check and US Social Security numbers. In n8n workflows it also finds keys typed into HTTP Request headers and URLs, open webhooks, pinned test data with personal data, and secrets inside Code nodes.
- What does Fix it change?
- Fix it applies fixed rules, never AI. It moves hardcoded keys in HTTP Request nodes to an n8n credential reference, removes pinned test data that holds personal data, and turns on Header Auth for open webhooks. It shows each change before you apply it, scans the result again and checks that it still imports as a workflow. Secrets inside Code nodes are listed for you to fix by hand.
- I found a key. Is moving it enough?
- No. A key that was saved in a shared file should be treated as leaked. Issue a new one, revoke the old one, and keep the new one in a credential. The scanner lists every key to rotate.