DEV Community

Kaewkamphon Suesirithamrong
Kaewkamphon Suesirithamrong

Posted on

A JSON Schema validator that runs in your browser and never downloads your $refs

#json #javascript #webdev #privacy

When I validate JSON against a schema, the data is often something I'd rather not paste into a random website: API responses, config files, payloads from work. So I built a JSON Schema validator that runs entirely in the browser, as part of DevTrove, my set of privacy-first developer tools.

👉 JSON Schema Validator

What it does

Paste a schema on one side and JSON data on the other, then press Validate (or Ctrl/⌘+Enter). You get either Valid or a list of errors. Each error shows:

  • where it is in your data, as a JSON Pointer path like /users/0/email;
  • what is wrong and which keyword failed;
  • where that keyword sits in the schema.

It supports Draft 2020-12 and Draft-07. The version comes from $schema, or from a Draft selector if the schema has none. Other drafts are rejected instead of being checked with the wrong rules.

Three things I cared about

1. Nothing leaves the page. The schema and the data are not uploaded, not stored and not put in the URL. Validation runs in a Web Worker, which is stopped after 5 seconds, so a pathological regex can't freeze the tab.

2. $ref is never fetched. References are resolved only inside the schema you paste (#/$defs/..., $id, $anchor, $dynamicAnchor). A reference to another URL is reported as an error rather than downloaded. If you need another schema, copy it under $defs. The official 2020-12 and Draft-07 metaschemas are built in.

3. Numbers are compared exactly. JavaScript reads 9007199254740993 and 9007199254740992 as the same number. This validator compares decimal values exactly, so the schema { "maximum": 9007199254740992 } rejects the data 9007199254740993, as it should. Likewise 1.0000001 is not a multiple of 1, and 0.30000000000000001 is not equal to 0.3.

Honest limits

  • format (email, date-time, …) is treated as an annotation, the 2020-12 default, so it is not checked. The page tells you how many format keywords it skipped.
  • Input is strict JSON: no comments or trailing commas, and duplicate keys are rejected.
  • Each box takes up to 1,000,000 characters.
  • I've tested it in Chromium-based browsers. Firefox and Safari aren't verified yet.

Try it

It's free, needs no sign-up, and has a Load example button if you just want to see it work:
https://dev-trove.com/tools/json-schema-validator

If you find a schema it gets wrong, I'd like to hear about it in the comments.

Top comments (0)