DEV Community

Chilam Chan
Chilam Chan

Posted on

Stop pasting sensitive JSON into random online formatters

#json #webdev #privacy #productivity

Every developer has done it: you get an ugly one-line JSON blob back from an API, and you paste it into the first "JSON formatter online" result to make it readable.

Here's the problem. Half the time that blob is a real response from your system — it can contain access tokens, internal IDs, customer emails, signed URLs, session data. The moment you paste it into a random web tool, you've sent that data to a server you don't control. You don't know if it's logged, cached, or sitting in someone's analytics pipeline.

For a side project, maybe you shrug. Inside a company with a compliance team, that's the kind of thing that ends up in an incident review.

The fix: format JSON in the browser, not on a server

You don't need a server to pretty-print JSON. Everything — parsing, formatting, validating, minifying — can happen entirely client-side with JSON.parse / JSON.stringify. The data never has to leave the tab.

// This is the whole "backend" of a JSON formatter:
const pretty = JSON.stringify(JSON.parse(input), null, 2);
Enter fullscreen mode Exit fullscreen mode

A tool built this way can even work offline once the page has loaded, because there's nothing to call home to.

How to check if a tool is actually client-side

Don't take a site's word for it. Open DevTools → Network tab, paste your JSON, hit format, and watch:

  • No new request fires → the work happened locally. Safe.
  • A request goes out with your JSON in the payload → your data just left the building.

Do this once with any "online" dev tool that eats sensitive input (JSON, JWT decoders, "beautifiers", diff tools). You'll be surprised how many phone home.

What I ended up using

I got tired of doing that Network-tab check every time, so I built a JSON formatter that's 100% client-side — format, validate, minify, nothing uploaded, no signup:

👉 https://boring-tools-6ip.pages.dev/json-formatter/

It's part of a small set of no-upload browser utilities I'm building solo. If you deal with sensitive payloads regularly, the "does this leave my machine?" habit is worth building regardless of which tool you land on.

What's your rule of thumb for pasting real data into third-party dev tools? Curious how others draw the line.

Top comments (0)