Do online JSON formatters upload your data? A 12-tool canary test

What we found

JSON Hero sent the canary marker in a POST request to its own jsonhero.io host while creating a document. We did not observe the marker in captured requests from the other tested, confirmed actions. Three tools were blocked by browser challenges, and three tools did not produce enough DOM evidence to confirm that their action ran. Tool Kumar made no request to a third-party host and reloaded while the network was disabled after its first visit.

“No marker observed” means the action was confirmed with DOM evidence and our capture found no raw, URL-encoded or base64 marker in request URLs, fetched POST bodies or sent WebSocket frames. “Action not confirmed” means the page accepted or displayed input but the captured evidence did not prove that the requested action completed. A dash means a browser challenge prevented a fair test.

Why test JSON formatters?

On November 25, 2025, watchTowr Labs published a report about public saved links on JSONFormatter and CodeBeautify. It says the researchers downloaded more than 80,000 saved submissions, covering five years of JSONFormatter and one year of CodeBeautify, and identified thousands of secrets. The report lists examples such as Active Directory credentials, cloud keys, CI/CD credentials, private keys, JWTs and personal information. It also describes a Save control, predictable saved-link formats and a Recent Links page.

The Hacker News and Security Affairs covered the same report. Their articles are useful context for the risk of treating a public save or share feature like a private scratchpad. Our experiment asks a narrower question: when a user pastes a new document and formats it, can a unique fake marker be seen leaving the page during that interaction?

Method

1. We selected eleven sites that appeared in checks for “JSON formatter”, “JSON viewer”, “JSON validator” or “JSON beautifier”, plus Tool Kumar for the same comparison. Search results vary by location and time.
2. In a fresh headless Chromium profile with cache disabled, we loaded each URL, waited seven seconds, pasted the same JSON and clicked the first visible control whose label matched format, beautify, validate, parse, submit, process, view, Go or Compare.
3. The JSON contained only fake values and a run-specific marker: TK-PRIVACY-CANARY-1791949677021-W5. We captured Chrome DevTools Protocol request events, fetched post data for requests that declared a body, recorded sent WebSocket frames and searched raw, URL-encoded, base64 and base64url forms. Transfer size is the sum of every Network.loadingFinished.encodedDataLength event, including the document, cross-checked against Performance API resource and navigation entries.
4. We recorded visible Save, Share, Recent Links or public-link language from the loaded page. After the first visit, we disabled the network and reloaded to check whether the page still rendered from its cache or service worker.
5. The run used Chromium 145.0.7632.0 on the test host, from an automated environment whose IP location was not asserted. The test date was October 14, 2026 UTC.

{
  "study": "json-formatter-privacy",
  "marker": "TK-PRIVACY-CANARY-...",
  "fake": {
    "email": "nobody@example.invalid",
    "token": "not-a-secret"
  }
}

The raw capture is available as JSON. It includes timestamps, browser version, request counts, host lists, transfer bytes and the exact status recorded for each site. The no-dependency runner script, screenshots and notes are kept with the research files for reproducibility.

How to read the table

A request to the site’s own host can be part of normal server processing. This run did not classify a site as “safe” or “unsafe”, inspect server logs, audit source code or test every button. Third-party host counts are a network observation, not a tracker verdict. A Save or Share label is a product feature; it does not by itself show whether a document is public, private, encrypted or retained for a particular period.

Tool Kumar is published by the same team that produced this study, so it is included under the same canary procedure. Its result is a measured observation from this run, not a request that readers take our word for it. You can repeat the test yourself and compare the downloaded data with your own DevTools capture.

Check any JSON tool yourself

1. Open a fresh private window and create a harmless marker such as TEST-CANARY-2026-XYZ. Never use a real password, API key or customer data.
2. Open DevTools, choose the Network panel and enable “Preserve log”. Filter by Fetch/XHR, then paste the canary and run the formatter.
3. Search request URLs and request payloads for the marker. Inspect the request host, method and response. A request to a remote host is evidence that data was sent in that request; absence of the marker is evidence only for that exact run and action.
4. Look for Save, Share, Recent Links or a generated URL. Treat a URL that reproduces the document as public until the service documents a different access model.
5. For offline behavior, visit once, switch DevTools to Offline and reload. A cached shell can still render while a later formatting action may need resources that are not cached.

Limitations

This was one run per site, from one automated browser and one network location. Challenges blocked JSONFormatter, JSON Editor Online and Curious Concept JSON Formatter, and we did not bypass them. Three loaded pages did not provide enough evidence to confirm the requested action. We did not create accounts, click a Save control, crawl saved links, inspect server-side retention or test mobile browsers. Ad auctions and third-party hosts can change between runs. The results describe this dated interaction, not a permanent property of any service.

Sources

• watchTowr Labs, “Stop Putting Your Passwords Into Random Websites” (25 Nov 2025)
• The Hacker News, “Years of JSONFormatter and CodeBeautify Leaks Expose Thousands of Passwords and API Keys” (25 Nov 2025)
• Security Affairs, “Thousands of sensitive secrets published on JSONFormatter and CodeBeautify” (28 Nov 2025)

If you need to format a document now, Tool Kumar runs the parser in your browser and is designed to keep the input on your device. You can still verify that claim with the DevTools steps above.