Private JSON Formatters Compared: Which Ones Upload Your Data?

Comparison table

Checked on 12 October 2026 in headless Chromium. “Payload sent?” records whether a unique marker from our test JSON appeared in any request URL, request body or WebSocket frame after we typed it in and pressed the tool’s format or validate button. “Third-party hosts” counts the distinct outside domains the page contacted in the roughly 20 seconds of the test; on ad-funded pages this changes from run to run with the ad auctions, so treat it as an order of magnitude.

“Not observed” covers one paste and one button press per tool; it is not a guarantee about every feature a site offers. “Service worker” means one was registered during the visit, which is how a web app keeps working offline; we did not test each tool with the network switched off.

How we tested

On 12 October 2026 we ran a scripted, headless Chromium browser (Playwright) against each tool’s main JSON page. For each site we:

1. loaded the page in a fresh profile and waited for it to settle;
2. typed a small object containing a random marker into the page’s own editor (Ace, Monaco, CodeMirror or a plain text area);
3. pressed the visible Format, Beautify, Prettify or Validate button where one existed (JSON Crack formats as you type);
4. logged every request, including its URL, method and body, plus WebSocket frames, and searched them all for the marker;
5. listed the distinct third-party hostnames the page contacted, and checked whether a service worker was registered.

Two sites could not be fully tested. Curious Concept returned a Cloudflare “Attention Required” block page to our automated browser, and on JSONLint our script could not get text into its editor, so for both the upload column says “not verified”. For PasteKit, which publishes this guide, requests to Google’s ad servers were blocked during the run so the test sent no automated traffic to its ad account; they are still counted as contacted hosts. Results change whenever a site deploys, so treat this as a dated snapshot and rerun the check yourself with the steps below.

Tool-by-tool findings

PasteKit. Formatting sent nothing containing the marker, and the page registered a service worker, so it keeps working offline after the first visit. Errors point to the exact line and column and the same site covers 50+ other formats. In fairness: PasteKit is funded by Google AdSense, whose script was one of the two third-party hosts; the other was Cloudflare Web Analytics. Its privacy policy describes both.

JSONFormatter.org. No request carried the marker when we validated. The page made about 2,100 requests to about 260 third-party hosts during the test, most of them advertising. It also offers save, load-from-URL and upload features; saving stores content on the site’s servers. In November 2025 watchTowr Labs reported that saved pastes from this site and CodeBeautify could be enumerated (see the secret leaks guide).

CodeBeautify JSON Viewer. Beautify sent no marker in our runs. The page made between about 2,600 and 4,800 requests to 300–375 third-party hosts, the heaviest load we saw. It has save and share features; avoid them for anything sensitive.

JSONLint. We could not confirm upload behaviour because our script could not type into its editor. The page credits the open-source @jsonlint/core package for validation and contacted about 250 third-party hosts, mostly advertising.

JSON Crack. A graph visualiser more than a plain formatter. Typing JSON into its editor produced no request containing the marker. We saw Google Analytics, Tag Manager, unpkg and Cloudflare, and no ad networks.

Curious Concept JSON Formatter. Blocked our automated browser, so nothing was measured.

privatejson.app. Prettify sent no marker. It loads Google Analytics through Tag Manager and shows a cookie consent banner.

Jsony. Format sent no marker, and its only third party was Cloudflare Web Analytics, the lightest page we tested. It links to its source code on GitHub.

How to check whether any formatter uploads your data

You do not need our script. Any Chromium or Firefox browser can show you the same evidence in about two minutes:

1. Open the formatter, press F12 (Cmd+Option+I on a Mac) and switch to the Network panel. Enable Preserve log, then clear the list.
2. Make up a marker nobody else would use, for example zebra-41-test, and put it inside a small JSON value. Never use a real secret for this.
3. Paste it, then press every button you would normally use: format, validate, minify, convert.
4. Search the Network panel (Ctrl+F or Cmd+F while it has focus) for the marker. Any hit in a request URL or payload means your text left the page.
5. Separately, sort by Domain to see how many outside companies the page talks to. Script files arriving are normal; your marker leaving is not.
6. Finally, choose Offline in the throttling menu and format again. A tool that still works cannot be relying on a server for that step.

Save, share, “load from URL” and upload features are a separate question: they may store content by design, so read what each one does before using it.

Related

• json formatter
• json validator
• online formatters and secret leaks
• json repair
• json viewer