JSON Formatter Security Risk: Why Client-Side Tools Matter

Most developers have pasted something sensitive into an online JSON formatter at least once: an API response with a token in it, a config file, a customer record. It’s quick, and it feels harmless. Reformatting JSON doesn’t seem like the kind of thing that could leak data.

In late 2025 it turned out that it can. Researchers showed that two popular formatters had been publishing what people saved, including credentials belonging to banks, consultancies, and security companies.

What Actually Happened in the 2025 Online Formatter Leak

The research came from watchTowr Labs, published in November 2025. They looked at two popular online formatters, JSONFormatter.org and CodeBeautify.org, and specifically at their Save feature, which turns whatever you just formatted into a shareable link.

What they found:

• Saved Payloads Were Publicly Discoverable: Both sites offered a “Recent Links” page listing saved content, and saved links followed a predictable URL format. Anyone browsing could retrieve what other users had saved.
• Years of Sensitive Data: The researchers collected more than 80,000 saved submissions covering roughly five years of JSONFormatter and one year of CodeBeautify content. Inside were Active Directory credentials, cloud keys, GitHub tokens, private keys, CI/CD secrets, and customer KYC data.
• Someone Else Was Already Looking: The team saved fake AWS credentials tracked as canary tokens. About 48 hours later, someone attempted to use them, which suggests the saved data was already being scraped and tested by others.

Most of the people who saved those payloads were likely just trying to share formatted output with a teammate. The convenience of a share link quietly turned private configuration into public data.

Is It Safe to Use an Online JSON Formatter?

When engineers ask whether online developer tools are safe, they usually assume the primary danger is a malicious site operator actively trying to steal their credentials.

While malicious honeypots do exist, the far more common danger comes from ordinary product decisions:

1. “Convenience” Features Create Server Copies: Features like “Share URL,” “Save Snippet,” or “Fork” require the server to store your payload. If those records aren’t protected by authentication or access control, your payload becomes public by default.
2. Third-Party Telemetry and Session Replays: Many ad-supported developer tools run analytics scripts, session replay software, or error-tracking services. If these libraries aren’t explicitly configured to mask form inputs, they can send keystrokes and pasted strings to third-party collectors.
3. Unnecessary Server Roundtrips: There is no technical reason to send JSON to a remote server just to format it. JavaScript has had native JSON.parse() and JSON.stringify() built into every browser engine for over fifteen years. When a tool sends your payload over the wire, it is usually to support features like saving, sharing, or server-side analytics, and every one of those creates a copy you don’t control.

// Dangerous: Traditional server-side utility pattern
async function handleFormatInput(rawJson: string) {
  // Unnecessarily ships your data across the network
  const response = await fetch('https://api.thirdparty-tool.com/format', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ data: rawJson })
  });
  return await response.json();
}

// Safe: Zero-trust client-side pattern
function handleClientFormat(rawJson: string) {
  // Pure in-memory transformation. Zero network egress.
  const parsed = JSON.parse(rawJson);
  return JSON.stringify(parsed, null, 2);
}

How to Verify That a Client-Side Tool Is Actually Safe

You don’t have to take any website’s marketing claims at face value. You can audit any developer tool yourself in about 30 seconds using your browser’s built-in DevTools.

Here is the exact verification workflow:

1. The Network Tab Check

1. Open Chrome DevTools, Safari Web Inspector, or Firefox Developer Tools (F12 or Cmd + Option + I).
2. Switch to the Network tab.
3. Click the clear button to empty the network log.
4. Paste your JSON into the tool and click “Format” or perform your transformation.
5. Watch the log.

If the tool is legitimately client-side, the Network tab should remain completely silent during interaction. If you see outbound POST, PUT, fetch, or XMLHttpRequest entries firing as you type or click, your payload is leaving your machine.

2. The Offline Verification

1. In the Network tab, find the network throttling dropdown (usually labeled “No throttling”).
2. Change it to Offline (or simply disconnect your Wi-Fi).
3. Paste a new JSON string and run the formatting action.

If the tool still formats your data without an active internet connection, its core engine is genuinely running locally in your browser’s JavaScript runtime.

3. The Content Security Policy (CSP) Inspection

A strict Content Security Policy adds a second layer. The connect-src directive controls which servers scripts on the page can contact, so with connect-src 'none' the browser refuses any fetch, XHR, WebSocket, or beacon request, even one made by a third-party script.

In DevTools:

1. Select the initial document request in the Network tab.
2. View Response Headers.
3. Look for Content-Security-Policy.

If you see connect-src 'none', your browser will block any fetch, XHR, or WebSocket connection that scripts on that page try to open. A short list of named servers is also reasonable, as long as you recognize them. CSP isn’t airtight (it doesn’t stop a script from navigating the whole page elsewhere), which is why the Network tab check comes first.

How I Built worktools.dev Around This

I built worktools.dev on one rule: the easiest way not to leak data is never to receive it.

The whole site is pre-rendered static HTML, CSS, and small Preact components. There are no server-side API routes and no database, so there’s nowhere for your input to go. Every page is served with a Content Security Policy that limits which servers scripts can contact; the current policy is on the Security page. And there are no session replay tools, tracking pixels, or third-party error trackers that could pick up what you type.

Before you paste internal API responses, database dumps, or auth tokens into an online utility, run the Network tab check. It takes about 30 seconds.

For a deeper look at how to architect and audit zero-egress web tools, see my companion post on Zero-Trust Client-Side Developer Tools.