#1We Audited 10 Online JSON Formatters: Privacy Claims vs Actual Network Behavior

Online JSON formatters are one of the most-used developer tools. Paste minified JSON, get pretty-printed output. Simple, right? The problem is that many of these tools silently upload your JSON to their servers for processing, despite claiming "local processing" or "privacy-first" on their landing pages.

We tested the 10 most popular online JSON formatters (ranked by Google search volume) by monitoring every network request each tool makes when you paste and format JSON data. The results are concerning: 4 out of 10 tools send your data to external servers.

#2Test methodology

For each tool, we:

1. Opened the tool in a fresh Chrome 128 incognito window with no extensions.
2. Opened DevTools → Network tab and cleared all recorded requests.
3. Pasted a 2 KB JSON payload containing realistic API response data (user profiles with email addresses, order IDs, and nested address objects).
4. Clicked "Format" or "Beautify" and waited for the result.
5. Recorded every network request that fired after the paste, excluding the initial page load, fonts, and analytics scripts.
6. Checked the request bodies for any portion of the pasted JSON payload.

We repeated each test 3 times to confirm consistency. We also tested with a 50 KB payload to check whether tools switch from client-side to server-side processing at larger sizes.

What we looked for:

• POST or PUT requests to any endpoint after pasting JSON
• Request bodies containing the pasted JSON data (full or partial)
• WebSocket connections opened after user input
• Third-party script execution that accesses the DOM containing the JSON

The test payload was a realistic API response with PII-like data: names, email addresses, order IDs, and nested objects. This represents what a developer might paste when debugging a production API response.

#2Results summary

4 out of 10 tools sent the pasted JSON to their servers. Three of those four explicitly claimed privacy or local processing on their landing pages. One used the phrase "enterprise-grade security" while uploading every paste to an API endpoint.

#2What data was sent, and where

For the 4 tools that made network requests, we inspected the request details:

All four tools sent the complete JSON payload, not a hash or summary. The data was sent as application/json in the request body. None of the tools disclosed this behavior in their UI before the request was made.

Tool H was the most egregious: it made two separate POST requests, one labeled "validate" and one labeled "format," effectively sending the same payload twice. The tool's landing page featured a lock icon and the text "Your data is safe with us."

#2Does payload size change the behavior?

We re-tested all 10 tools with a 50 KB JSON payload. The results:

• Tools A, B, F, G, I: No change. Zero network requests at both 2 KB and 50 KB. These tools process everything client-side regardless of size.
• Tools C, E, H, J: Same behavior. They sent the 50 KB payload to their servers just as they sent the 2 KB payload.
• Tool D: No change. It sent data at both sizes, but at least it never claimed privacy.

No tool switched from client-side to server-side processing based on payload size. The behavior was consistent: tools that upload data at 2 KB also upload at 50 KB.

#2Feature comparison: what you get locally vs remotely

We compared the formatting features available on the 6 honest local tools versus the 4 server-side tools:

The server-side tools tend to offer more features (schema validation, format conversion) because they can run heavier processing on their backend. But the local tools cover the essentials: pretty-printing, minification, and basic validation.

If you need schema validation or format conversion, the server-side tools are more capable. But you should know that your data is being uploaded, and you should not paste production secrets, PII, or regulated data into them.

#2How to verify a JSON tool yourself

You do not need to trust our results. Here is how to check any JSON formatter in under 60 seconds:

1. Open the tool in Chrome.
2. Press F12 to open DevTools.
3. Click the Network tab.
4. Check the Preserve log checkbox (prevents clearing on navigation).
5. Paste your JSON and click Format.
6. Watch the Network tab. If any new request appears (other than the page's initial load), the tool is sending data somewhere.

For extra assurance, click on each request and check the Payload tab in the request details. If your JSON data appears there, the tool is uploading your input.

You can also block all network requests after page load using Chrome's Offline mode in the Network tab. If the tool still works, it is truly client-side. If it breaks, it depends on server communication.

#2Why this matters for developers

JSON data often contains sensitive information:

• API responses with user emails, phone numbers, and addresses
• Configuration files with database connection strings and API keys
• JWT token payloads with user claims and session data
• Environment variables exported as JSON from CI/CD systems

Pasting any of these into a tool that uploads to a server means your data is now on someone else's infrastructure. Even if the tool claims to "not store" the data, it has been transmitted, logged by the server, and potentially cached by intermediate proxies.

For regulated environments (HIPAA, PCI-DSS, SOC 2), uploading data to an undisclosed third-party server is a compliance violation, regardless of whether the server "stores" it.

#2Recommendations

Based on this audit:

1. Use browser-based JSON tools that process locally. Our own JSON Formatter is one of 6 tools in this audit that processes everything client-side. Others exist, but verify with the Network tab.

2. Never paste production data into a tool you have not verified. Even if the landing page says "privacy-first," check the Network tab yourself. Marketing copy is not a technical guarantee.

3. For schema validation and format conversion, prefer open-source CLI tools. ajv (JSON schema validation), jq (JSON querying), and json (Node.js format conversion) all run locally and can be installed via npm or your system package manager.

4. If you must use a server-side tool, sanitize first. Replace sensitive values with placeholders before pasting. Use jq '(.users[] | .email) = "REDACTED"' to strip PII before formatting.

5. Bookmark tools you have verified. Once you confirm a tool is client-side using the Network tab test, bookmark it. You will not need to re-test unless the tool updates its implementation.

Written by Rahul Jalavadiya, founder of AllDevToolsHub. All tools run locally in your browser.

#2Sources / Further reading

• MDN - DevTools Network panel reference
• OWASP - Data Protection Cheat Sheet
• FTC - Guides on Deceptive Advertising (16 CFR Part 238)
• W3C - The JSON Data Interchange Syntax (RFC 8259)

#2Try These Tools on AllDevToolsHub

• JSON Formatter — A privacy-first JSON formatter that runs entirely in your browser with zero network requests
• JSON Schema Validator — Validate JSON structure locally without uploading data to any server
• JSON Minifier — Minify JSON client-side to reduce payload size without server round-trips

All tools run entirely in your browser. No sign-up, no data upload, no server round-trips.