Security

How to share an n8n workflow safely

By Muhammad Muneeb · Published 28 July 2026 · 6 min read

An n8n workflow export does not contain your stored credential secrets — those stay in n8n and the file only references them by id and name. What it can contain is pinned execution data from your test runs, which is real customer records, and any key you typed straight into a node field, such as an Authorization header pasted in from a cURL import. Check both before sending the file — or send a rendered image instead, which carries neither.

What is actually in the file#

An exported workflow is a JSON document with three interesting parts. Knowing which is which is most of the job:

nodes[].parameters — everything you typed into a node. URLs, queries, expressions, JavaScript in Code nodes, and any key you pasted into a header field. This is where inline secrets hide.
nodes[].credentials — a reference, not a secret: an id and the display name of the credential. It tells a reader that this node authenticates as Acme Prod Stripe; it does not give them the key.
pinData — sample output captured when you pinned a node during testing. This is the one people forget, and it is frequently a real API response with real customer records in it.

Checking a file before you send it#

Two greps get you most of the way. The first tells you whether pinned data is present at all; the second looks for the field names that typically hold a pasted key.

shell

# is there pinned execution data?
jq 'has("pinData")' workflow.json

# which nodes have it, and how big
jq '.pinData | keys' workflow.json

# obvious inline secrets in node parameters
grep -Eio '"(authorization|api[-_]?key|token|secret|password)"[^,]*' workflow.json

security

If you drop the workflow into the Pixtex editor and create a share link, the same scan runs for you: pinned data is stripped before anything is hosted, and parameters that look like a bearer token, an sk_/ghp_-style key, a JWT or a PEM private key are flagged so you can decide. Nothing is auto-redacted — a silently mangled workflow that imports broken is worse than a warning you can act on.

The safest answer is usually a picture#

Most of the time the person asking does not need your workflow, they need to see it. A rendered diagram carries the node types, the names, the connection topology and the branch structure — enough to debug a routing problem or review an architecture — and carries none of the parameters, none of the pinned data and none of the credential references.

That is the whole argument for posting an image on the community forum instead of a JSON blob, and it is why the forum answer you get back tends to be faster: the reader can see the shape immediately instead of importing a file to look at it.

When you do have to send the JSON#

Strip pinData first — jq 'del(.pinData)' workflow.json.
Send a subset. Selecting a few nodes on the n8n canvas and copying them produces valid workflow JSON for just that fragment — usually all a support thread needs.
Prefer a link that expires over an attachment that does not. A Pixtex share link lasts 24 hours; an email attachment lasts as long as the mailbox.

what to remember

Credential secrets stay in n8n; the export references them by id and display name only.
pinData is the real exposure — it is captured test output, and it is usually real customer records.
Run jq 'del(.pinData)' before you send a file, and rotate any key that has already left your disk.
A rendered image answers most "why does this branch not fire" questions and carries no parameters.

written by

Muhammad Muneeb

Built the renderer behind Pixtex — the n8n node registry it draws from, the verified n8n community node, and the census of 10,957 public templates it was tested against.

github.com/VicegerentPrince ↗

Questions

Does an exported n8n workflow contain my credentials?

Not the secrets. Credentials live in n8n and the export references them by id and name only, so the file reveals which account a node uses but not the password or token behind it. Anything you typed directly into a node parameter — an API key in an HTTP header field, for instance — is a different matter and is stored in the workflow itself.

What is pinData in an n8n workflow file?

Pinned data is the sample output n8n keeps when you pin a node during testing, so the workflow can be re-run without hitting the real service. It is often a real API response containing real names, emails or order records, and it travels inside the exported JSON. Strip it before sharing.

What is the safest way to show someone my workflow?

Send an image of it. A rendered diagram shows the structure, the node types and the connections — everything needed to answer "why does this branch not fire" — while carrying no parameters, no pinned data and no credential references at all.

Do Pixtex share links expire?

Yes. A share link lives for 24 hours and then the workflow behind it is deleted. Deleting one sooner requires the delete token issued when the link was created. Hosted images are the opposite: those are permanent until you remove them, and each one has a permanent page you can send instead of a file.

Try it on your own workflow

In n8n: open the workflow, ⋯ menu, Download. Drop that file on the editor and export a PNG, SVG or PDF. Free, no account, nothing to install.

Open the editor →Render it from code

now do yours