How to Check Any n8n Workflow Before You Trust It With Real Data

Tested by TNT Review — record TNT-TEST-2026-10-04-003, 5 October 2026. We ran the checker below against a genuinely safe workflow and a deliberately unsafe one we built for this test, and found and fixed a real bug in our own first version along the way. What exactly was tested is set out in Verification.

The problem

You have downloaded or been handed an n8n workflow — maybe one of ours, maybe someone else’s. Before you import it and point it at your real inbox, your real spreadsheet, or your real customer data, there are three questions worth answering that most people never check: can you test it safely, does it hide its own failures, and is there a password sitting inside the file in plain text?

None of these require reading every node by hand. They can be checked automatically, in under a second, before you ever open n8n.

Expected outcome

By the end of this guide you will have a small script that reads any exported n8n workflow file and tells you, in plain terms, whether it is safe to try. You will also see it catch a real mistake — including one we made ourselves while building it.

Requirements and costs

• Node.js (version 18 or newer) to run the checker.
• An exported n8n workflow file (the .json you get from Download in the n8n editor, or any workflow you were sent).
• Cost: free. No n8n instance has to be running, no account, no API key.

The three checks, and why each one matters

1. Does it have a Manual Trigger? Without one, the only way to run the workflow at all is to let its real trigger fire — a webhook receiving a real request, a schedule hitting a real time, an email arriving in a real inbox. That means your first “test” is actually your first real run.
2. Does anything fail silently? An HTTP Request or Code node with no error handling set can fail partway through and the workflow will simply stop, or worse, continue as if nothing happened. A workflow that cannot tell you when it failed will eventually fail without telling you.
3. Is there a hardcoded secret? n8n has a proper credential store for API keys and passwords. A workflow file that has one pasted directly into a node’s settings instead means that key travels with the file — to you, and potentially to anyone else who gets a copy.

Step-by-step implementation

1. Download the checker from the link below and save check-before-trust.js next to the workflow file you want to check.
2. Open a terminal in that folder.
3. Run it, naming your workflow file:

   node check-before-trust.js your-workflow.json

4. Read the output. Each of the three checks reports true or false. Anything false comes with a one-line reason — that is the thing to look at before you import the file.

A real example

We ran it against our own already-published n8n workflow (the verbatim-support check from an earlier guide), and separately against a workflow we built on purpose to fail every check:

$ node check-before-trust.js tnt-verbatim-support-check.json
{
  "checked": 3, "passed": 3,
  "findings": [
    { "check": "has a manual trigger for safe testing", "ok": true },
    { "check": "no node silently swallows a failure", "ok": true },
    { "check": "no hardcoded secret-shaped value", "ok": true }
  ]
}

$ node check-before-trust.js bad-example.json
{
  "checked": 3, "passed": 0,
  "findings": [
    { "check": "has a manual trigger for safe testing", "ok": false,
      "detail": "no Manual Trigger node found -- ..." },
    { "check": "no node silently swallows a failure", "ok": false,
      "detail": "Send (no error handling, hardcoded key) have no onError/retryOnFail set" },
    { "check": "no hardcoded secret-shaped value", "ok": false,
      "detail": "sk_liv..." }
  ]
}

The bad example failed all three, exactly as it was built to. The first version of our own checker actually missed the hardcoded key on the first attempt — it was testing the whole quoted value (“Bearer sk_live_…”) as one piece, and the space in the middle meant the pattern it was looking for never matched. Fixed by checking each word in a value on its own, then re-run to confirm the catch.

Verification and troubleshooting

What we tested, on 5 October 2026 (record TNT-TEST-2026-10-04-003): the checker run against a genuinely safe, already-published workflow (3 of 3 passed) and against a hand-built unsafe one designed to fail every check (0 of 3 passed, each for the stated reason). The bug described above was found and fixed during this same test, not discovered later.

Troubleshooting:

• It says “usage: node check-before-trust.js <workflow.json>” and stops. You ran it with no filename. Add the path to your workflow file after the command.
• A node you know has error handling still gets flagged. The checker looks for n8n’s own onError or retryOnFail properties on the node. If you are relying on a separate Error Trigger workflow elsewhere instead, this checker will not see that connection — it only reads the one file you give it.
• It flags something that isn’t actually a secret. Any 20+ character run of letters, digits and a few symbols with no spaces can look secret-shaped, including some long IDs. Use your own judgement on the flagged value; the checker’s job is to point you at it, not to be certain for you.

Limitations and alternatives

This reads the file structure; it does not run the workflow, so it cannot catch a problem that only appears at execution time, and it cannot see credentials that are correctly stored in n8n’s own credential system (which is exactly where they should be — this checker is looking for the ones that are not). It also cannot judge whether the workflow’s LOGIC is correct, only whether it is structurally safe to try.

The alternative is reading every node by hand before you import anything, which works but does not scale past the first workflow someone sends you.

Free resources

The download contains the checker and the deliberately unsafe example used above, so you can see it fail before you ever run it against something real.

Download the workflow trust check (ZIP, 3 KB)

Need help implementing this?

Is there a paid version?

Not yet. This is the complete method. TNT Review has sold nothing to date and has no checkout, so any price we discuss in future should be read as a hypothesis, not an offer.