An online JSON formatter is safe for sensitive data only if it formats your input in the page and never sends or saves it. Many tools do send input to a server, and some publish it through save or share links. Check any tool with the browser's Network tab first, never use its save feature for real data, and keep live secrets out of every web tool.
What makes an online JSON formatter safe or unsafe
A JSON formatter is safe when your text stays inside the browser tab and nothing keeps a copy. There are two separate questions: where the formatting happens, and whether the tool stores the result.
Formatting itself is trivial for JavaScript, so a page can do it locally. The risk comes from tools that post your text to a server to format it, and from tools that save it so you can share a link. A saved paste lives on someone else's server, under a URL that someone else might find.
| Tool behaviour | What happens to your JSON | Risk for secrets |
|---|---|---|
| Formats in the page, no save feature | Stays in your browser tab | Low, once you've checked |
| Formats on a server | Sent over the network, may be logged | You can't see what's kept |
| Save, share or "recent" links | Stored and given a URL | High: the URL can leak |
| Browser extension | Runs with the extension's permissions | Depends on the extension |
The 2025 saved-links leak
The clearest real example of the risk is the saved-links exposure that watchTowr Labs published in November 2025. The watchTowr Labs research describes "80,000+ downloaded submissions" and "5GB+" of JSON data from jsonformatter.org and CodeBeautify, covering 5 years and 1 year of history respectively.
The researchers found Active Directory credentials, database credentials, private keys, CI/CD pipeline credentials, administrative JWT tokens and personal data. The cause wasn't a hack. It was a Recent Links page that the researchers call "a by-design feature" of both sites, which let anyone browse saved content.
BleepingComputer's report adds that the saved pages followed "a structured, predictable URL format", so a simple crawler could collect them. As of November 2025, it said the Recent Links pages were still freely accessible.
The detail that should change your habits: watchTowr saved fake AWS keys with a 24-hour expiry, and someone tried to use them 48 hours after the upload. People are already scraping these pages for credentials.
How to check a formatter with the Network tab
You can see for yourself whether a formatter sends your input anywhere, in about a minute, with Chrome DevTools. The Chrome DevTools Network guide explains that the Network panel logs all network activity, but only while DevTools is open.
- Open the formatter page.
- Press Control+Shift+J (Command+Option+J on a Mac) to open DevTools, then click the Network tab.
- Paste a harmless sample such as
{"canary": "check-me"}and click format. - Watch for new rows. Click any request that appears and look at its payload for
check-me. - Type part of your sample into the Filter box to narrow the list.
If your sample shows up in a request, the tool uploads your input. Don't paste production data into it.
A second test: go offline
The offline test catches tools that hide uploads among other traffic. Load the formatter, then turn off your Wi-Fi or unplug the network cable. Paste and format your sample again.
A tool that works in the page still formats. A tool that needs its server shows an error or spins forever. This doesn't prove the page won't send your text later once you're back online, so use it alongside the Network tab, not instead of it.
Client-side tools still load other scripts
Even a client-side formatter page usually loads code from other servers. OnlineViewer Dev shows what to look for. It's a static site with no application backend, its tool code makes no network requests with your input, and pasted text isn't saved. A service worker also caches the tool pages, so they open offline after the first visit.
The limitation: the pages still load Google Analytics, Google Fonts and Font Awesome from third-party servers. Analytics records page visits, not your input, but those are scripts you didn't write running next to your data. If that matters, use the private JSON formatter offline, or format locally.
What you should never paste into any web tool
Some data belongs only in local tools, however trustworthy the website looks. My rule: if leaking it would mean a password reset, a key rotation or a breach notice, it doesn't go into a browser tab I haven't checked.
- Live credentials: API keys, cloud access keys, database connection strings, private keys.
- Session tokens: production JWTs, especially admin tokens, which are passwords in disguise.
- Customer records and health or payment details, which count as personal data.
For those, format locally. Formatting JSON in VS Code takes one shortcut, and pretty-printing JSON in Python or with jq works from a terminal. Redacting secrets before you paste removes most of the risk.
What to do if you already pasted a secret
If a secret went into a formatter that uploads or saves input, revoke or rotate it now. Deleting the paste isn't enough. The OWASP Secrets Management Cheat Sheet says potentially compromised secrets must be revoked, and that stolen credentials "remain usable until the backing service expires or revokes them."
GitHub's secret scanning docs give the same order of work: rotate the credential immediately. Cleaning up copies matters less once the key no longer works. Then check the service's access logs for use you don't recognise.
FAQ
Do online JSON formatters store my data?
Some do. Any tool with a save, share or history feature keeps your input on its server. A tool that formats in the page and has no save feature has nothing to store, but you should still check the Network tab.
How can I tell if a JSON formatter uploads my data?
Open Chrome DevTools, click the Network tab, then paste and format a harmless sample. If a request appears that carries your text, the tool sends it to a server.
Is it safe to paste a JWT into an online tool?
A JWT is often a live credential. Treat it like a password: decode it locally or only in a tool you have checked, and never paste a production admin token anywhere.
What should I do if I pasted an API key into a formatter?
Revoke or rotate the key right away. OWASP notes that stolen credentials stay usable until the backing service expires or revokes them, so deleting the paste is not enough.