Is this JSON formatter safe for confidential data?

It processes documents locally, with no paste upload. You still need to trust the delivered code, your browser and extensions. For secrets, verify the requests, use a tested offline tab and clear local storage afterward.

Does the site use analytics?

Yes. Vercel Web Analytics records page telemetry. The wrapper strips URL fragments, and the application has no configured event that sends editor contents. Analytics requests are separate from local JSON processing.

What does the Content Security Policy protect?

The page CSP blocks framing, restricts base URLs to this origin and blocks embedded objects. It has no script-src or connect-src directive, so it does not restrict all scripts or network destinations.

Does my JSON remain after I close the tab?

User-edited documents up to 2,500,000 characters can persist in this browser's localStorage, along with compare text and settings. Clear site data on shared devices. Visiting a preset page alone does not replace the saved homepage document.

Can I paste JWTs or API keys?

Use a harmless sample to verify offline operation first, then prefer an offline tab for secrets. Extensions with access to the page can still read the editor. A decoded JWT is not a verified token, and a leaked key should be revoked.

Secure JSON formatter with browser-local processing

How to use this tool

Open DevTools and select Network. Wait for the page to finish loading, then clear the request list.
Paste harmless JSON with a unique marker such as network-check-7 and edit a value. The formatter should update without a request containing that marker.
Inspect any new requests, especially their Payload tabs. Check both Fetch/XHR and All, since analytics can use beacon requests. This takes about 30 seconds with a small sample.

Worked example

The same local formatter produces this output online or after its application assets have been cached for offline use.

Input

{"user-id":42,"display name":"Ada","class":true,"profile":{"city":"London","created_at":"2026-10-14T09:00:00Z"},"items":[{"sku":"A1","price":12,"note":null},{"sku":"B2","price":12.5,"note":"gift"}],"metadata":null}

Output

{
  "user-id": 42,
  "display name": "Ada",
  "class": true,
  "profile": {
    "city": "London",
    "created_at": "2026-10-14T09:00:00Z"
  },
  "items": [
    {
      "sku": "A1",
      "price": 12,
      "note": null
    },
    {
      "sku": "B2",
      "price": 12.5,
      "note": "gift"
    }
  ],
  "metadata": null
}

What browser-local processing protects

A formatter that uploads JSON gives a server access to the document. Here, parsing and formatting use the browser parser code, and generated downloads use local browser APIs. The ordinary paste flow has no request that carries the document.

The Network check above verifies the current session. It does not prove what every future version will do. Repeat it after updates when the data warrants that care.

Analytics and third-party requests

The site uses Vercel Web Analytics to record page views, not document contents. In production, the analytics script loads from /_vercel/insights/script.js on this same origin and sends page telemetry through /_vercel/insights. URL fragments are stripped by the application wrapper before events are sent. Avoid putting secrets in URL paths or query parameters.

The code font is self-hosted at build time, so using this page does not request a font from Google. The source audit found no other analytics integration. A user-requested remote URL fetch is an exception to the normal local input flow.

Read the actual security headers

The page Content-Security-Policy is shown below. It blocks embedding this page in a frame, changing its base URL to another origin and loading object/embed content. It does not set script-src, default-src or connect-src on pages.

Other configured headers include nosniff, X-Frame-Options: DENY, strict-origin-when-cross-origin and a Permissions-Policy disabling camera, microphone, geolocation, payment and USB. The service-worker response has a separate, stricter CSP.

frame-ancestors 'none'; base-uri 'self'; object-src 'none'

Handle JWTs, API keys and saved documents

Disable unneeded extensions with page access. Confirm the cached app works with networking disabled before pasting a token or key. Keep secrets out of share links, screenshots and browser URL queries.

User edits can remain in localStorage, which is not an encrypted secrets vault. Close other Tool Kumar tabs and clear the site's local storage, cache storage and service worker through browser site-data settings after sensitive work.

Use a JWT decoder to inspect claims, then verify signatures in your own application. If a credential has already been exposed, revoke or rotate it; formatting cannot undo disclosure.

Options and edge cases

The parser, code generators and download creation run locally. Opening a local file does not upload it.
Vercel Web Analytics records page views. In production, its script is served from this origin at /_vercel/insights/script.js and telemetry uses /_vercel/insights; the wrapper removes URL fragments before events are sent. No document-content events are configured in the code.
A shared link puts JSON in the URL fragment. The fragment is not sent in an HTTP request, but anyone who has the full link can read the document. Avoid sharing secrets.
Load from URL explicitly fetches the chosen endpoint in your browser. That endpoint sees a request. A ?url= link can also trigger remote loading; use paste or a local file for sensitive work.

Private by default

Your document stays in this browser. Tool Kumar parses, converts and creates downloads on your device, with no account or upload step.

Secure JSON formatter questions

Is this JSON formatter safe for confidential data?: It processes documents locally, with no paste upload. You still need to trust the delivered code, your browser and extensions. For secrets, verify the requests, use a tested offline tab and clear local storage afterward.
Does the site use analytics?: Yes. Vercel Web Analytics records page telemetry. The wrapper strips URL fragments, and the application has no configured event that sends editor contents. Analytics requests are separate from local JSON processing.
What does the Content Security Policy protect?: The page CSP blocks framing, restricts base URLs to this origin and blocks embedded objects. It has no script-src or connect-src directive, so it does not restrict all scripts or network destinations.
Does my JSON remain after I close the tab?: User-edited documents up to 2,500,000 characters can persist in this browser's localStorage, along with compare text and settings. Clear site data on shared devices. Visiting a preset page alone does not replace the saved homepage document.
Can I paste JWTs or API keys?: Use a harmless sample to verify offline operation first, then prefer an offline tab for secrets. Extensions with access to the page can still read the editor. A decoded JWT is not a verified token, and a leaked key should be revoked.