JSON formatter, validator and tree viewer

Why an offline JSON tool matters now

In November 2025 the security research firm watchTowr Labs published findings about two of the most widely used online code-formatting utilities. Both offered a “save” or “share” feature that stores a submission on the server and hands back a short link. The links were generated from a predictable, enumerable identifier — so anyone willing to count upwards could walk the entire archive, including submissions the person who pasted them had never intended to publish.

The researchers reported recovering more than 80,000 stored files, over 5 GB of data accumulated across roughly five years. The contents were exactly what you would expect developers to paste into a formatter while debugging, and exactly what you would least like to find in a public bucket:

• Active Directory credentials and domain administrator passwords.
• Cloud provider access keys and API tokens.
• Database connection strings, complete with hostnames and passwords.
• Private keys, session tokens and CI/CD secrets.
• Personal data belonging to customers of banks, government departments, healthcare providers, universities and — with a certain grim irony — cybersecurity companies.

To test whether anyone was actually harvesting the archive, the researchers planted canary credentials: realistic-looking but fake secrets that would report back if used. They were exercised within days. This was not a theoretical exposure of dormant data; it was a live, monitored supply of working credentials.

None of this required a breach. No attacker compromised a server. The data was simply stored, given a guessable address, and left reachable. The failure was architectural: the tool had somewhere to put your data, so eventually your data was there.

Read the reporting yourself

• The Hacker News — coverage of the watchTowr Labs research Summary of the research, with the categories of secret recovered.
• BleepingComputer — how the stored links were enumerated Covers which sectors the affected organisations were in and how the links were enumerated.
• SecurityWeek — “Thousands of secrets leaked on code formatting platforms” Additional detail on the scale and on the canary-credential experiment.

What to do if you have used one of those sites

1. Assume anything you pasted into a hosted formatter is public. Not “probably fine” — public.
2. Rotate every credential that could have appeared in one of those payloads: database passwords, API keys, service-account tokens, webhook secrets, JWT signing keys.
3. Check your provider’s access logs for use of those credentials from unfamiliar addresses, going back as far as your retention allows.
4. Change the habit, not just the keys. Redact before you paste, or use a tool that has nowhere to put the data.

The wider lesson is not about two specific websites. It is that a formatter has no technical reason to be a network service at all. Parsing JSON is something every browser has done natively since 2011. A page that sends your document to a server to add whitespace to it has chosen to take custody of your data for no functional benefit.

How it works

Everything on this page is client-side JavaScript, split into two small files with no dependencies between them and nothing fetched from anywhere.

Parsing

Your text goes to the browser’s built-in JSON.parse. That is the same parser your application uses, written in C++ and shipped with the browser, so a document this page accepts is a document your code will accept. Nothing here uses eval or the Function constructor — a JSON tool that evaluated its input would be a genuine security hole, because a payload could then run code in your session rather than merely being read.

Explaining the failure

When JSON.parse refuses, its message is famously unhelpful and differs between engines: Chrome says one thing, Firefox another, Safari a third, and some of them give you a character offset with no line number. So this page runs a second pass — a strict RFC 8259 scanner written specifically to find and name the first mistake. It reports:

• the line and column, converted from the character offset by counting newlines, plus the raw character index;
• the offending line itself, with a caret under the exact character (long lines are windowed around the caret, so a 4 MB single-line document still gives you something readable);
• a named cause where one can be identified — trailing comma, single-quoted string, unquoted key, NaN, a Windows path with an unescaped backslash, a byte order mark, a comment, two concatenated documents, an HTML error page arriving where JSON was expected.

The scanner is an explicit state machine with its own stack rather than a recursive function, so a pathologically nested document produces an error message instead of a “maximum call stack size exceeded”. It is cross-checked against JSON.parse on twenty thousand randomly mutated documents; the two agree on every one about whether the input is valid.

Formatting and minifying

Pretty-printing is JSON.stringify(value, null, indent); minifying is JSON.stringify(value). Both operate on the parsed value, not on the text, which is why the output is always canonically formatted and why formatting doubles as a validation step. Note the consequence: comments, trailing commas and original key order inside a re-serialised object are not preserved, because they were never part of the parsed value. Key insertion order is preserved, except that integer-like keys are hoisted and sorted — that is a rule of the JavaScript object model, not a choice made here.

The tree

The tree is built lazily. On load it opens about three hundred rows and stops; deeper nodes are constructed only when you expand them, and any node with more than two hundred children renders them in pages. That is what keeps a multi-megabyte array from producing hundreds of thousands of DOM nodes and freezing the tab. Collapsed containers show their size — {…} 12 keys, […] 340 items — so you can judge a subtree without opening it.

The tree is a proper ARIA tree widget: arrow keys move and open, ← collapses or jumps to the parent, Enter toggles, Home and End jump to the ends, and * opens all siblings of the focused node.

Escaping

Every fragment of your document that reaches the page is written with textContent, never by assembling an HTML string. Paste a value containing <img src=x onerror=alert(1)> and it renders as those literal characters in the tree, in the output pane and in any error message. For a tool whose entire input is untrusted text, that is the one bug that would matter most.

Worked examples

<!DOCTYPE html>
<html><head><title>502 Bad Gateway</title></head>

{
  // service settings
  'host': "db.internal",
  port: 5432,
  replicas: 3,
}

{
  "host": "db.internal",
  "port": 5432,
  "replicas": 3
}

Frequently asked questions

Use cases and limitations

What people use this for

• Reading an API response. A minified response body pasted from the network tab becomes readable in one keystroke, and the tree lets you collapse the parts you do not care about.
• Finding the syntax error in a config file. package.json, tsconfig.json, a Terraform variables file, a Kubernetes manifest — when a tool says only “invalid JSON”, this says which character.
• Checking a payload before sending it. Paste a request body you are about to POST and confirm it parses and has the shape you meant.
• Understanding an unfamiliar document. The tree plus the depth and key counts tell you the shape of a response faster than scrolling.
• Shrinking a value. Minifying before writing to a column, a cookie, a QR code or an environment variable.
• Comparing two versions. Format both with the same indent and paste them into any diff tool; identical formatting removes the whitespace noise.

What it deliberately does not do

• Repair broken JSON. It tells you precisely what is wrong and where, but it will not guess where a missing brace belongs. Automatic repair is how a subtle corruption gets committed with confidence.
• Accept JSON5, JSONC, HJSON or YAML. Comments, trailing commas, unquoted keys and single quotes are reported as the errors they are. A lenient parser would let you ship a file that your production runtime rejects.
• Validate against a schema. Syntax only.
• Preserve byte-for-byte formatting. Output is re-serialised from the parsed value; see the FAQ above.
• Sort or transform. No key sorting, no JSONPath queries, no filtering language. For transformations, jq is the right tool and it runs on your machine.

Honest limitations

Numbers pass through JavaScript’s IEEE 754 doubles, so integers beyond 2⁵³ and decimals such as 0.1 are subject to the usual floating-point rounding. Very large documents are limited by tab memory: a browser tab that runs out will be terminated by the browser, and a document larger than a few hundred megabytes is a job for a streaming parser such as jq, ijson or Jackson’s streaming API, not for any browser page. Lone surrogates in \u escapes are accepted, matching JSON.parse, even though they cannot be encoded as valid UTF-8.

More JSON tools on this site

• JSON validatorCheck syntax and get the exact line and column
• JSON minifierStrip whitespace and see the byte saving
• “Unexpected token” explainedEvery cause of the most common JSON error
• Escape & unescape stringsTurn text into a JSON string literal and back
• About this toolWhy it's built this way, and what it deliberately doesn't do

Related tools

• Regex testerTest and debug regular expressions against sample text

See all the tools on this site →