Automation Planning · Free Tool
n8n Workflow Auditor
Paste an exported n8n workflow and get a health score with the security, reliability, and maintainability issues to fix: hardcoded secrets, open webhooks, missing error handling, and more.
Checked entirely in your browser. Still, strip real credentials from anything you paste into any website.
About this tool
Most n8n workflows that break in production fail for the same handful of reasons: an API key pasted straight into an HTTP Request node, a webhook anyone can call, no error workflow so failures go unnoticed, and API calls that give up on the first timeout. This auditor reads an exported workflow and checks for each of them, plus disconnected and disabled nodes, pinned test data, shell-command nodes, and plain-HTTP requests.
Every finding names the nodes involved and the fix. Secrets are masked in the report, and the whole check runs in your browser, so the workflow is never uploaded. It is a static review: it cannot see your instance configuration, credential permissions, or the data that flows through at run time, so treat a clean result as a good sign, not a guarantee.
Common uses
- Check a workflow before switching it on in production or handing it to a client
- Review a template or a workflow built by someone else before importing it
- Find out why a workflow fails quietly, and what to change so failures alert you
Frequently asked questions
How do I export a workflow from n8n?
Open the workflow, click the three-dot menu at the top right, and choose Download. You can also select all nodes on the canvas (Ctrl/Cmd+A) and copy them, which puts the same JSON on your clipboard.
Are credentials included in an n8n export?
Credentials saved in n8n are not: the export only contains their ID and name. Values typed directly into node fields (an API key in a header, a password in a URL) are included, which is exactly what this auditor looks for.
What does an error workflow do?
It is a separate workflow that starts with an Error Trigger and runs whenever a workflow that points to it fails. Typically it posts the failed workflow name, node, and error message to Slack or email so someone fixes it before the backlog grows.
Is my data uploaded to a server?
No. This tool runs entirely in your browser using JavaScript, so nothing you type is transmitted, logged, or stored anywhere. You can even use it offline once the page has loaded.