# GraphQL Query Decoder

> Pretty-print a GraphQL query or schema document and read the operations, variables and fragments in it.

- Page: https://decoder.tools/graphql-decoder
- Category: Web, API & Tokens
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A GraphQL query decoder takes a GraphQL request, often minified, URL-encoded or embedded in JSON, and prints it as a readable document with its operation, variables and fragments.

## Example

```text Input
{"operationName":"GetUser","query":"query GetUser($id: ID!) { user(id: $id) { id name posts(first: 2) { title } } }","variables":{"id":"42"}}
```

```text Output
query GetUser($id: ID!) {
  user(id: $id) {
    id
    name
    posts(first: 2) {
      title
    }
  }
}
Operation: GetUser
```

Paste the whole request body and the query is pulled out of the JSON and pretty-printed, with the variables shown below it.

## What a GraphQL request looks like

Over HTTP, GraphQL is usually a `POST` with a JSON body:

```json
{
  "operationName": "GetUser",
  "query": "query GetUser($id: ID!) { user(id: $id) { name email } }",
  "variables": { "id": "42" }
}
```

- **query** is the GraphQL document. In traffic it's typically a single line.
- **variables** holds the values for `$id` and other parameters.
- **operationName** picks one operation when the document contains several.

GET requests put the same fields in the URL, so the query is percent-encoded (`?query=query%20GetUser…`). Decode those with the [URL decoder](/url-decoder) first.

**Persisted queries** replace the query text with a hash, for example `"extensions":{"persistedQuery":{"version":1,"sha256Hash":"…"}}`. The server looks the query up by its hash, so there is no query text in the request to decode.

## How to use the GraphQL decoder

1. Paste the request — a JSON body with `query`/`variables`, a URL-encoded GET request, or a bare GraphQL document.
2. Read the formatted query, with its operation name, fragments and variables.
3. A request with only a `sha256Hash` and no query text is a persisted query; the hash is shown, but the query itself lives on the server.

## GraphQL at a glance

| | |
|---|---|
| Specification | GraphQL Specification (graphql.org) |
| Transport | Usually HTTP POST with a JSON body |
| Operations | `query`, `mutation`, `subscription` |
| Introspection | `__schema` and `__type` queries return the schema |

## FAQ

### How do I see the GraphQL schema of an API?

Run an introspection query (`{ __schema { types { name } } }`) if the server allows it. Many production APIs disable introspection for security.

### Why is the query missing from the request?

The client uses persisted queries, and only a hash is sent. The full query text lives on the server or in the client's build output.

### Is GraphQL encrypted?

No. The request is plain JSON. Only TLS (HTTPS) protects it in transit.