Power Query in an Excel workbook: the source paths, server names and steps a query keeps after the data is loaded
Last updated: 28 October 2026
Short answer: a table loaded with Power Query (Data › Get Data) is not only its values. The workbook keeps the query too: every step recorded in the Power Query Editor, written as a formula that can name the source file's full path, a server and database, a SQL statement, the columns you removed and the values you filtered on, along with details of the last refresh. Microsoft's file format documentation says all of this is stored in a custom XML part of the .xlsx, base64 encoded, with the formulas in a package inside it, so a text search of the unzipped file does not find them. Anyone who opens the workbook in Excel for Windows, or in a recent Excel for Mac, can read the steps in the Power Query Editor. Read each query before you send the file, and delete the queries the recipient does not need.
This page is about the queries themselves. The connection that ties a query to the sheet, and other full paths in a workbook, are in full paths in Excel workbooks; the copy of the source data a pivot table keeps is in pivot caches; and custom XML parts in general are in custom XML and embedded objects.
A query is a list of recorded steps
Microsoft's page About Power Query in Excel says: "The Power Query Editor keeps track of everything you do with the data by recording and labelling each transformation, or step, that you apply to the data." It adds: "Each transformation is recorded as a step in the background. You can even modify and write your own steps using the Power Query M Language in the Advanced Editor." When you refresh, "each step runs automatically". Its page Manage queries (Power Query) says that "When you create a query, connection information is created behind the scenes."
So the steps stay in the workbook for as long as the query does, including steps that took something out. The loaded table shows the result; the query shows how it was made and where from.
What a query's steps can name
The steps are formulas in the Power Query M language. Microsoft's M function reference shows what the common ones take as arguments:
- A file's path. File.Contents takes
path as textand "Returns the contents of the file, path, as binary". A query built on a file names it by its path, so a query built on a workbook or CSV in your user folder, or on a server and share, can say where that is. - A server, a database and a SQL statement. Sql.Database takes
server as textanddatabase as text, and an optionQuery, "A native SQL query used to retrieve data". The statement can name tables and columns the recipient never sees. - The columns you removed. Table.RemoveColumns "Removes the specified columns from the table provided", so the step that removes a column names it. The loaded table does not have the column; the query still has its name.
- The values you filtered on. Table.SelectRows keeps its condition in the step (the reference's example is
each [CustomerID] > 2), so a customer number or a name you filtered out is written there.
Microsoft's page Manage data source settings and permissions describes where data source credentials are managed (Data › Get Data › Data Source Settings, for "Data sources in current workbook" or "Global permissions"); it does not say where they are stored. [MS-QDEFF], described below, names no part for credentials, but anything typed into a step, such as a server name or a key in an address, is part of the formula.
Where the query is in the .xlsx
Microsoft's specification [MS-QDEFF]: Query Definition File Format describes "a structure that is used to store the Power Query Formulas of the queries in a spreadsheet and their associated metadata". Its overview says: "It is stored within a CustomXML Part in the spreadsheet file."
| What | What it holds | Where it is |
|---|---|---|
| The container | All the queries of the workbook, base64 encoded; an optional sqmid, "An arbitrary GUID used to correlate the spreadsheet for telemetry" | A file in the customXml folder whose root element is DataMashup (2.1 Root Element) |
| The formulas | "the Power Query Formula for each query in the spreadsheet": every step, with its paths, servers and filters | /Formulas/Section1.m, a plain-text file in a package inside the decoded container (2.3.2 Section1.m) |
| The privacy settings | Whether privacy levels are used and the workbook's privacy level | The Permissions part of the container (2.4 Permissions) |
| Details of each query | Among others: "The date/time of the most recent refresh", "The number of rows retrieved", "List of the column names retrieved", "The message for the error that occurred in the most recent refresh", and "The name of the worksheet the query was loaded to most recently" | The Metadata XML part of the container (2.5.1 Metadata XML) |
The container is base64 text: once decoded, it holds the package with the formulas and the other parts, one after another (2.2 Top-level Binary Stream), and that package is an Open Packaging Conventions package, the same kind of ZIP package as the .xlsx itself (2.3 Package Parts). That is why searching the unzipped .xlsx for a path or a server name can find nothing even when a query names it. A refresh error message, a sheet name or a column name can be kept in the details of a query the same way.
The query also has a connection, in xl/connections.xml, and a query loaded to a sheet fills a table there; both are described in full paths in Excel workbooks. A query can also be loaded to the Data Model (the metadata entry AddedToDataModel, "Whether the query has been loaded to the spreadsheet data model"); this page does not cover the Data Model.
Who can see it
Anyone who opens the workbook in a version of Excel with Power Query. On Windows, Data › Queries & Connections lists the queries on its Queries tab; Edit opens a query in the Power Query Editor, where each step is listed and the Advanced Editor shows the formula (the Manage queries page lists Advanced Editor among the commands of the Queries pane in the editor). Microsoft's page Import and shape data in Excel for Mac (Power Query) describes the Power Query Editor there too, for Microsoft 365 subscribers "running Version 16.69 (23010700) or later" (another section of the same page still says "authoring in the Power Query Editor is not available in Excel for Mac"), and the Manage queries page says Excel for the web shows "all queries in the current workbook along with query details, such as row count, last refresh date, location, and load status."
Opening the workbook somewhere that cannot reach the source does not hide the query: the steps are in the file, and the recipient sees them whether or not a refresh works.
What Document Inspector covers
Microsoft's page Remove hidden data and personal information by inspecting documents, presentations, or workbooks lists, for Excel, "Inactive external data connections" among what the Document Properties and Personal Information inspector removes, and a Custom XML Data inspector that removes "Custom XML data that might be stored within a workbook". The page does not mention Power Query or queries, so it does not say whether either inspector removes a query's container. Check a copy afterwards, as below.
Read and remove queries in Excel
- Work on a copy. Open Data › Queries & Connections and look at the Queries tab: every query of the workbook is listed there, including queries loaded only as a connection.
- For each query, select Edit and read its steps in the Power Query Editor, then open the Advanced Editor and read the whole formula: file paths, server and database names, SQL statements, the columns removed and the filters.
- Open Data › Get Data › Data Source Settings with "Data sources in current workbook" selected, to see every source the queries use.
- If the recipient does not need to refresh the data, delete the queries: right-click each one on the Queries tab and select Delete, which the Manage queries page describes as "Removes a query." That page does not say what happens to the table the query loaded, or to the query's connection. For connections, Microsoft's page Create, edit, and manage connections to external data says that removing one does not remove any object or data from the workbook. Check the sheets, and the Connections tab of Data › Queries & Connections, afterwards. Another way is to copy the loaded tables and paste them as values into a new workbook.
- If the recipient does need to refresh, take out the steps that say more than they need, and point the sources at a location they can use, with Change source in Data Source Settings.
- Save, close and check the copy you are about to send, as below.
Check a copy of the file
- Make a copy of the .xlsx, rename it to .zip and unzip it.
- If there is a
customXmlfolder, open eachitemfile. One whose root element isDataMashupholds the workbook's queries. If none is, the file has no Power Query container in this form. - To read the formulas, decode the base64 text of that element with a base64 tool. The result starts with four bytes for the version and four for the length of the package (2.2 above), least significant byte first; the package follows, and other parts come after it. Save just that many bytes, from the ninth byte on, as a .zip, and open
Formulas/Section1.m. Decoding Microsoft's example gives the length bytes 45 03 00 00, that is 837, and a package that starts at the ninth byte with the letters PK, as ZIP files do. - Open
xl/connections.xml, if there is one, for the connections, and thexl/queryTablesfolder, if there is one, for the tables they fill. - Finding nothing this way shows only that these searches found nothing, not that the file holds nothing else.
What ScrubDrop does
ScrubDrop reads the .xlsx in your browser; it is not uploaded. For free, one file at a time, it lists the query container as a custom XML part, by its file name only (for example customXml/item1.xml; with several custom XML parts, open each as above to see which one is DataMashup), and the workbook's connections under links to other files, among the other kinds of hidden data it supports. It does not decode the container, so it does not list the query names, paths or servers inside it: read those in Excel as above. The free version removes the document properties and comments and accepts tracked changes; the queries and connections stay.
The [MS-QDEFF] pages we read do not say in which text encoding the container part is written. ScrubDrop reads custom XML parts as UTF-8, and we checked what this section says only with synthetic workbooks whose container is UTF-8. A part in another encoding, such as UTF-16, makes ScrubDrop stop with an error for that file: nothing is listed and no file is offered. Read and delete the queries in Excel as above. A workbook's Data Model was not tested for this page; parts ScrubDrop does not keep are listed as such and are not written to the new file (see the limits).
ScrubDrop Pro removes custom XML parts, and the query container goes with them; it removes links to other files, and the connections go with them. The two are separate choices. A query loaded to a table on a sheet fills that table from its connection, and removing links to other files is then refused, with the sentence "A table in this workbook is filled from a data connection being removed. Convert it to a range in Excel first, or untick links to other files." With custom XML chosen and links to other files unticked, the query container goes and the connection and the table stay, so the connection then points at a query that is no longer there: delete the queries in Excel instead, or convert the tables to ranges first and then choose both. A query loaded only as a connection goes with both chosen. The values in the cells stay. The result is read again with separate parsers, and a file that does not pass is not offered. Macro-enabled workbooks (.xlsm) are not opened: save them as .xlsx first.
Questions
If I send only the loaded table, can the recipient see my query?
Yes, if you send the workbook. The query is saved in the workbook with the table, and anyone who opens it in Excel for Windows, or a recent Excel for Mac, can open the Power Query Editor and read its steps, including the source's path and the columns you removed. To send the values alone, paste them into a new workbook, or delete the queries in a copy.
Why does a search of the unzipped file not find my file path?
Because the queries are stored base64 encoded. Microsoft's [MS-QDEFF] says the container is a custom XML part whose content is base64; the formulas are a plain-text file in a ZIP package inside it. Decode it and open the package inside, or read the queries in Excel.
Does Document Inspector remove Power Query queries?
Microsoft's Document Inspector page does not say. It lists inactive external data connections and custom XML data for Excel, and does not mention Power Query. Check the customXml folder of a copy after running it.
Sources: the Microsoft pages linked on this page were checked on 28 October 2026. ScrubDrop is not affiliated with Microsoft.
See the custom XML parts and connections an .xlsx keeps, in your browser. Free: one file at a time; every supported kind of hidden data it finds is listed, and properties, comments and tracked changes are removed. Check a file.