Your plan stays in this tab. This page's code never sends it, and its security policy makes your browser refuse outgoing connections. Your browser refuses this page's outgoing connections. Check it yourself

0 requests sent since this plan loaded

Planreader

A Terraform plan viewer that shows what will actually happen

For Terraform and OpenTofu. Paste plan text from a CI log, or the JSON from terraform show -json.

or drop a file anywhere

You're looking at a sample plan. Everything in it is invented.

Read this first

    Pull request summary

    Addresses, actions, reasons and attribute names only. It never contains attribute values, so it's safe to post where the plan isn't.

    Everything, by module

    Each parcel is one resource, and each block is one module. Lines run from the selected parcel to everything in this plan that refers to it, solid for direct references and dashed for indirect ones.

    Get a plan out of your pipeline

    JSON gives the fullest picture: the exact attribute that forced each replacement, and which resources refer to which. You need a saved plan file first.

    terraform plan -out=tfplan
terraform show -json tfplan > plan.json
    tofu plan -out=tfplan
tofu show -json tfplan > plan.json

    Only have a CI log? Paste the text. Colour codes and log timestamps are removed for you, and Planreader checks what it finds against the plan's own "Plan: 3 to add" line and warns you if they differ. Text output marks a forced replacement only where the provider reports one, and it has no reference data, so the lines on the map need JSON.

    Treat plan files with care. HashiCorp's documentation says that sensitive values are saved in cleartext in the plan file, even when the terminal hides them.

    Check that nothing leaves this page

    Don't take our word for it. There are three ways to test it, and none takes more than a minute.

    1. Ask the page to send something. This button tries to reach another website, and the browser's answer appears next to it.
    2. Watch the network. Open your browser's developer tools at the Network tab, then paste a plan. No new request appears.
    3. Pull the plug. Load this page, turn off your connection, then paste a plan. It works just the same, because all the reading happens here.

    The rule behind this is the page's Content-Security-Policy, which your browser enforces. This is the policy this page loaded with. connect-src 'none' is the part that refuses connections, and the others stop scripts, styles, fonts, images and forms from going to or coming from other sites:

    Your plan isn't saved in cookies or browser storage, and it isn't put in the address bar. Closing or reloading the tab discards it. Read the privacy page for what the host does see, and for what this can't protect against, such as browser extensions. The code isn't minified, so you can read it in your browser too.