A JSON formatter that checks for secrets before you paste (because someone has to)

In November 2025, researchers found more than 80,000 saved JSON snippets sitting in public on two of the biggest online formatters, full of cloud keys and passwords. So my free JSON formatter scans what you paste for secrets, offers to redact them before you copy, download or share, and never sends your JSON anywhere. It also does YAML, JSON paths and 20 MB files.

1 Nov 2026 · 6 min read

jsonyamldeveloper-toolsfree-toolssecuritysecrets

Every developer has done it. A 400-line API response comes back as one horrible line, you copy it, you google "json formatter", you paste it into the first result. And somewhere in that blob is an Authorization header, a database URL with the password in it or an AWS key someone logged by accident.

Usually nothing happens, and occasionally that key ends up somewhere very public.

What actually happened with the online formatters?

A single document leaking a small blue key through a crack in an open folder

In November 2025, researchers at watchTowr went through the saved snippets on JSONFormatter and CodeBeautify, two of the most popular formatting sites around. Both had a "Recent Links" feature for saved output, and saved links followed a predictable URL format. They pulled more than 80,000 saved JSON entries, and in them found Active Directory credentials, GitHub tokens, cloud keys, private keys, CI/CD secrets and personal data. They planted a fake AWS key as a test, and someone tried to use it about 48 hours later.

The leak came from the save and share features, and from the fact that nobody checks what's in a blob of JSON before they hit "save".

text

$ history | grep "how did this get leaked"
  1  curl api.example.com/debug > response.json
  2  # copy, google "json formatter", paste
  3  # click "Save & Share" so a teammate can see it
  4  # 48 hours later: why is our AWS bill $14,000

What makes a JSON formatter safe to use?

My checklist, written after reading that report and then nervously auditing my own browser history:

Runs in the browser. Formatting is a solved problem. There's no reason for your JSON to touch a server.
Tells you about secrets before you copy, download or share.
Share links that can't leak. If there's a share button, the data should live in the link itself and secrets should be stripped.
Errors with a line and column. "Unexpected token" without a location is a riddle.
Handles big files without freezing the tab.
~~"Save to our cloud"~~. See above.

How do the popular JSON formatters compare?

They're all fine at the actual formatting. The differences are in what happens around it.

Formatter	Good for	Watch out for	Honest assessment
JSONLint	Quick validation	Basic tooling beyond validate and format	The classic. Does one thing.
JSONFormatter / CodeBeautify	Huge set of converters	Saved links were scraped in the 2025 report, plus a lot of ads	Fine for test data. I wouldn't paste production responses.
`jq` in your terminal	Scripting, huge files, filtering	You need to remember jq syntax	The right answer if you live in a terminal.
Your editor's "Format document"	Files already on disk	No secret checks, no YAML conversion	Perfect when the JSON is already a file.
Sidd's JSON formatter	Pasting real responses safely, JSON to YAML, copying paths	It's a formatter, so no saved history (on purpose)	Built by someone who read the incident report twice.

How does the secret scan work?

As soon as your JSON parses, the tool walks every string, number and comment and checks it against a set of rules modelled on gitleaks, the open-source secret scanner. On by default:

Rule	Example of what it catches
Private key	`-----BEGIN RSA PRIVATE KEY-----` blocks
AWS keys	Access key IDs and secret access keys
GitHub, OpenAI, Anthropic, Stripe, Slack, Google keys	Tokens in each provider's known format
JSON Web Token	A full `eyJ...` token sitting in a field
Password in a connection string	`postgres://admin:hunter2@db...`

You can also switch on stricter checks: any value under a key that looks like password, apiKey or DB_ACCESS_TOKEN, card numbers (with a Luhn check so random digits don't trigger it), email addresses and random-looking high-entropy strings. Obvious placeholders like ${PASSWORD} or changeme are skipped, so it doesn't nag you about your .env.example.

Then, when you click Copy, Download or Share with secrets in the input, you get a dialog:

flowchart LR
    A[Click Copy / Download / Share] --> B{Secrets found?}
    B -- no --> C[Done]
    B -- yes --> D[Dialog lists what it found]
    D --> E[Redact and copy]
    D --> F[Copy anyway]
    E --> G["Value becomes [REDACTED:aws-secret-key]"]

Redaction replaces only the secret, in place, so the rest of your JSON keeps its shape. A password inside a connection string becomes postgres://admin:[REDACTED:connection-string]@db..., and the host and database name are still there for whoever is debugging.

Is it actually private?

Yes, and I'd prefer you check than trust me: open DevTools, go to the Network tab and paste your JSON. No requests are made. Formatting, validation and the secret scan all run in your browser, and inputs over 1 MB move to a Web Worker so the page stays responsive while it thinks.

What else does it do?

The boring-but-useful list:

Format, minify or convert to YAML, with 2 spaces, 4 spaces or tabs, and an optional sort keys toggle that sorts nested objects too.
Paste YAML, get JSON. The formatted and minified tabs turn YAML into JSON. If your YAML had comments, it warns you that JSON can't keep them.
Errors with a line and column, marked in the editor. Broken JSON like {"a": 1,} is reported as broken JSON, even though it happens to be valid YAML.
Click any value to get its path, then copy it as JSONPath, jq, JavaScript or Python. No more counting brackets to write data["items"][3]["price"].
Large number warning. Integers past 15 digits (Twitter-style IDs, I'm looking at you) can lose precision in JavaScript. The tool flags them so you don't "format" an ID into a different ID.
Stats in the status bar: lines, size and how many levels deep your JSON goes.
Up to 20 MB of input.

FAQ

What is the best free online JSON formatter?

For everyday work, one that formats and validates in your browser, shows errors with a line and column and doesn't save your data anywhere. My JSON formatter adds a secret scan and redaction on top. For very large files or scripting, use jq.

Is it safe to paste JSON into an online formatter?

It depends on the site. Formatters that save or share your input on their servers have leaked credentials before. Use one that runs in the browser (check the Network tab), and redact keys and passwords before sharing.

How do I validate JSON online?

Paste it into the JSON formatter. Valid JSON is formatted straight away. Invalid JSON shows the error and the exact line and column it happens on.

How do I convert JSON to YAML, or YAML to JSON?

Paste JSON and pick the YAML tab. Paste YAML and use the formatted or minified tab to get JSON.

Paste it into the formatter, then click Copy, Download or Share. If it finds keys, tokens or passwords, choose Redact and each one is replaced with a label like [REDACTED:openai-key].

How big a JSON file can it format?

Up to 20 MB. Anything over 1 MB is processed in a background worker so typing stays smooth.

Want to try it?

Open the JSON formatter, leave the sample it opens with (it has a fake AWS key and a database password in it) and hit Copy. Watching it catch the key is weirdly satisfying. There are more free tools on the site too, including a JWT decoder that does the same trick for tokens.

If it misses a secret format you care about, email me at siddhant06137@gmail.com or ping me on X as @creatorsidd. And if your team needs internal tools built with this kind of paranoia, book a 15-minute call.