How to Redact Internal Directives, Bearer JWTs, and PII Variables from GraphQL Schemas & Query Logs in Local Browser RAM

Description and use

GraphQL Schema & Query Token Redactor removes internal directives, JWTs, admin secrets, and PII from GraphQL artifacts while preserving schema structure, operating entirely in the browser.

Problem

Exported GraphQL artifacts (SDL, introspection JSON, operation variables) can leak internal directives, admin headers, session JWTs, plaintext PII, and expose the API blueprint to third parties.

Outcome

The tool removes internal directives, JWTs, admin secrets, and PII from GraphQL artifacts while maintaining schema structure, enabling safe sharing of sanitized data.

Workflow

• Export .graphql SDL files, __schema introspection JSON, or operation variables dumps.
• Paste or upload the artifacts into the GraphQL Schema & Query Token Redactor sandbox in the browser.
• Select desired redaction depth (35%, 70%, or 95%).
• Review the sanitized output in the browser.
• Copy or download the sanitized payload (free 70% plaintext export).
• If needed, use the standalone offline HTML5 workstation for large batch sanitization.

Evidence

Engineers regularly export .graphql Schema Definition Language (SDL) files, __schema introspection JSON payloads, and operation variables dumps.

Source

Internal RBAC & Federation Directives: Custom directives like @auth(role: ADMIN), @internal(upstream: "http://10.24.8.19:8080"), or federation @link URLs expose your internal microservice topology.

Source

Admin Headers & Session JWTs: Exported GraphQL trace logs often retain Authorization: Bearer <JWT>, x-hasura-admin-secret, or session cookies.

Source

Plaintext PII in Operation Variables: A failed CreatePaymentIntent or UpdateCustomerProfile mutation dump almost always carries real customer emails, billing addresses, card tokens, or SSNs inside the variables JSON object.

Source

To solve this without requiring a $49/seat/month cloud workspace, we built GraphQL Schema & Query Token Redactor (073-graphql-schema-inspector), which executes 100% inside local browser RAM.

Source

3-Tier Redaction Depth Slider (35% / 70% / 95%)

Source