Free tool · runs in your browser · sends nothing
Share the workflow, not your keys.
Paste an n8n workflow export. The scrubber finds API keys, credential references, webhook URLs, email addresses and saved test data, and gives you back a clean file that still imports. Your browser blocks this page from sending anything anywhere.
Step 1
Paste or open your workflow
In n8n, use Download from the workflow menu, or select nodes and copy them. Either works.
Step 2
Check what was found
Step 3
Take the clean file
Highlighted text is what the scrubber put in. Each different value has its own number, so the same key used in two nodes shows up as the same placeholder.
How it works
What it does, and why you can trust it
Nothing leaves your browser
The page sets a security policy that your browser enforces: no network requests, no form posts, nothing loaded from other sites. To check, open the developer console on this page and run fetch('https://example.com'). The browser refuses.
It knows n8n
It removes credential references, webhook ids, pinned test data, saved trigger state and the fingerprint of your n8n server. n8n creates new ones on import, so nothing breaks. It keeps the fields n8n needs to import the workflow and removes the rest.
Same value, same placeholder
A key is replaced everywhere it appears, in every written form, with one numbered placeholder. If a node’s name holds a client’s name, the connections and $('Node') references follow the new name. A short password like “admin” is replaced only where it was found, so an IF node that checks for “admin” still works.
It checks its own work
Before you get the file, it checks that the JSON is valid, that every node and connection survived, that no removed value is left anywhere, and that a fresh scan finds nothing new. If any check fails, you get an error and no file.
Limits
What it can’t find
- A secret with no recognizable shape and no telling label. A random password in a field called “value” looks like any other text.
- Secrets built at run time, split across fields, encoded or encrypted.
- Personal details in free text. It finds email addresses, phone numbers and card numbers, but not names or street addresses. That is why saved test data is removed by default.
- Your clients and your business. It can’t know who your clients are (add them to “Also remove these words”), or which prompts and rules you consider confidential.
- Other copies of a short password. A password like “admin” is replaced where it was found as a password, not everywhere the word appears.
- Numbers stored as numbers, and files such as images or PDFs saved inside test data.
The tests, the measured detection rates and the design decisions are all in the source repository.