Written by Sam Taylor — Full-Stack Developer. I test tools before I trust them with my data. More about me →
Last month I caught myself pasting a production API response — complete with customer email addresses and order IDs — into a random JSON formatter I found on Google. I stopped mid-paste, looked at the URL bar, and realized I had no idea whether that site was processing my data locally or shipping it to a server. So I tested seven popular JSON formatting tools to find out.
I created a JSON payload containing a unique canary token — a URL that would trigger an alert if anyone accessed it — and pasted it into each tool. If the tool sent the data to a server, the canary would fire and I'd know exactly when and from which IP the server fetched it.
Three tools processed everything locally — the canary never fired, and the Network tab in Chrome DevTools confirmed zero outbound requests after the initial page load. These were the browser-based JSON beautifiers that use JavaScript's JSON.parse and stringify in the browser.
Four tools sent my JSON payload to a remote server. Two of them did it transparently — the formatting happened server-side and the response came back formatted, which the privacy policies mentioned in fine print. One of them sent the data to an analytics endpoint that logged the full JSON body, not just metadata. The fourth sent it to a third-party API that I couldn't identify from the domain name.
Here's the practical upshot: if you're formatting JSON that contains anything proprietary, customer PII, authentication tokens, or internal API structures, you need a JSON formatter that runs entirely in the browser. The quickest verification: open Chrome DevTools → Network tab → paste your JSON → if you see any outbound XHR or fetch requests after paste, your data is leaving your machine.
Three checks I now do before using any formatting tool. First, the DevTools Network tab test — paste data and watch for outbound requests. Second, disconnect your internet after the page loads — a true browser-based JSON validator should keep working offline because all the logic is in the JavaScript that already downloaded. Third, check the privacy policy for phrases like "your data never leaves your device" or "all processing is done locally." If you see "we collect usage data to improve our service" without specifying what "usage data" includes, assume it includes your JSON.
The whole test took 20 minutes and permanently changed which tools I use. For anything sensitive, I now use only browser-local tools where I can verify in DevTools that nothing is being transmitted. For public data or documentation examples, server-side tools are fine — but the habit of pasting production data into random websites is a security incident waiting to happen.
Written by Sam Taylor — Full-Stack Developer. I test tools before I trust them with my data. More about me →