Pretty-Print JSON Without Leaking Tokens: A Local Checklist for API Debugging

Answer first: If the payload might contain access tokens, PII, or internal IDs, format it in your browser on your machine before you paste it into a ticket or a “free online JSON” site. Cloud formatters are convenient — and they are also a third party that briefly holds every key in the response. Below is a practical checklist plus a local workflow.

Why this keeps showing up

Support threads and Discord pastes still treat JSON beautifiers like notepads. The useful takeaway is not another brand name — it is a habit: treat the response as sensitive until you have redacted it, then share a trimmed copy once.

Pre-format checklist (2 minutes)

1. Know what is secret. Authorization, refresh tokens, emails, internal URLs. Assume the whole blob is hot until proven otherwise.
2. Prefer local format over “upload then hope the host deletes it.” Fewer hops means fewer accidental leaks into vendor logs.
3. Watch the Network tab. Open DevTools → Network, clear the log, paste a non-sensitive sample. Pass = no multipart POST carrying your JSON to a third-party API.
4. Airplane-mode sanity check. After page assets load, go offline and retry. If pretty-print still works, upload-to-server architecture is off the table for that action.
5. Redact before you share. Replace tokens with *** in the copy you put in Linear/Jira, not in the live response you keep locally.

A local format workflow

Step 3 — Redact

Search for Bearer, token, @, and internal hostnames. Strip or mask before paste.

Step 4 — Share once

Skip the detour through a random “free JSON online” host for payloads you would not email to a stranger.

One browser-local starting point

When you need an on-device formatter without creating an account, this JSON Formatter runs in the tab (files stay on your device):

https://www.lizecheng.net/dev/json-formatter/?utm_source=devto&utm_medium=article&utm_campaign=lizely_daily_20260920&utm_content=json-formatter

(That is the only product link in this post.)

What “good enough” looks like

Scenario	Local move
Debug a 401 with a huge body	Format locally → redact → paste snippet
Share sample webhook payload	Format → strip secrets → ticket
Compare two API versions	Format both locally; do not upload either
Tokens in nested objects	Search the tree before any cloud hop

Closing

JSON formatting is a solved UX problem. The open question is whether the bytes leave your device on the way. Prefer tools you can verify with Network + offline checks — and keep cloud beautifiers for files you would not mind a stranger reading.

Step 1 — Capture the response

Copy from DevTools or save the .json from your client. Keep the original offline.

Step 2 — Pretty-print in the tab

Format locally. Closing the tab should clear in-memory copies; the file you download (if any) is the artifact you keep.