Compare Salesforce profiles across orgs — or within one org — audit permission risk, and generate a deployable sync with rollback.
Connect two or three orgs with a CLI token, or paste their .profile-meta.xml — or load the sample to explore.
Permission drift is the quiet cause of "it worked in UAT." Someone grants a field on one org to unblock a test, nobody records it, and the difference only surfaces when a release behaves differently in production. Finding it afterwards means reading two profile XML files side by side, or clicking through Setup on two orgs at once.
Profile Drift Console loads profiles from up to three orgs, computes a diff matrix across object permissions, field-level security, Apex class and Visualforce access, user permissions and tab visibility, then scores what actually carries risk rather than listing every difference equally. It can also generate a deployable sync package with the profile XML, a package.xml and a regression checklist.
Do I have to connect an org?
No. You can paste .profile-meta.xml files directly, or load the sample data to see how it works. Connecting an org just saves you the retrieve step.
Does it change anything in my orgs?
No. It reads permissions and produces artefacts. The sync package it generates is a file you review and deploy yourself through your normal process — nothing is deployed from the browser.
What is the difference between "differences only" and "drift"?
Differences shows every value that isn't identical across the orgs being compared. Drift narrows to where orgs that should match have diverged — which is usually the shorter and more actionable list.
Why did loading profiles fail with an HTTP 400?
Salesforce's describe lists permission columns that SOQL rejects when the related feature or licence is off in that org. The console parses the rejection, drops the offending column and retries, and surfaces the untruncated API error if it still fails.
Does it handle permission sets?
The comparison is profile-centric. Profiles are where drift is hardest to see, because permission sets are usually deployed deliberately while profile edits happen ad hoc.
Is my permission data uploaded anywhere?
No. Nothing is stored server-side and the comparison runs in your browser. See the trust page.
How many permissions can it handle?
It has been run against real orgs at several thousand permissions per comparison. Very large matrices are heavy on the browser, so compare the profiles you care about rather than everything at once.
What does it cost?
Nothing. No account, no trial, no paid tier.