A GraphQL query decoder takes a GraphQL request, often minified, URL-encoded or embedded in JSON, and prints it as a readable document with its operation, variables and fragments.
Example
{"operationName":"GetUser","query":"query GetUser($id: ID!) { user(id: $id) { id name posts(first: 2) { title } } }","variables":{"id":"42"}}query GetUser($id: ID!) {
user(id: $id) {
id
name
posts(first: 2) {
title
}
}
}
Operation: GetUserPaste the whole request body and the query is pulled out of the JSON and pretty-printed, with the variables shown below it.
What a GraphQL request looks like
Over HTTP, GraphQL is usually a POST with a JSON body:
{
"operationName": "GetUser",
"query": "query GetUser($id: ID!) { user(id: $id) { name email } }",
"variables": { "id": "42" }
}- query is the GraphQL document. In traffic it's typically a single line.
- variables holds the values for
$idand other parameters. - operationName picks one operation when the document contains several.
GET requests put the same fields in the URL, so the query is percent-encoded (?query=query%20GetUser…). Decode those with the URL decoder first.
Persisted queries replace the query text with a hash, for example "extensions":{"persistedQuery":{"version":1,"sha256Hash":"…"}}. The server looks the query up by its hash, so there is no query text in the request to decode.
How to use the GraphQL decoder
- Paste the request — a JSON body with
query/variables, a URL-encoded GET request, or a bare GraphQL document. - Read the formatted query, with its operation name, fragments and variables.
- A request with only a
sha256Hashand no query text is a persisted query; the hash is shown, but the query itself lives on the server.
GraphQL at a glance
| Specification | GraphQL Specification (graphql.org) |
| Transport | Usually HTTP POST with a JSON body |
| Operations | query, mutation, subscription |
| Introspection | __schema and __type queries return the schema |
Frequently asked questions
How do I see the GraphQL schema of an API?
Run an introspection query ({ __schema { types { name } } }) if the server allows it. Many production APIs disable introspection for security.
Why is the query missing from the request?
The client uses persisted queries, and only a hash is sent. The full query text lives on the server or in the client's build output.
Is GraphQL encrypted?
No. The request is plain JSON. Only TLS (HTTPS) protects it in transit.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown