The JSONFormatter and CodeBeautify Exposure Explained: What Developers Should Do

October 30, 2026 · 5 min read

In November 2025, security firm watchTowr Labs published research reporting that JSON snippets saved on jsonformatter.org and codebeautify.org could be collected through the sites' public "Recent Links" pages, and that the collected data contained credentials such as cloud keys, tokens and passwords. If you ever used the save or share feature on either site with real data, assume those values were exposed: find what you saved, rotate the secrets and check the access logs.

This article sticks to what was publicly reported, explains why it happened in general terms, and gives a practical checklist. It is not a judgement of either site's operators; the underlying lesson applies to any tool that stores what you paste.

What was reported

The research was covered by security outlets including Help Net Security and Security Affairs. According to that coverage:

• Both sites offered a feature to save formatted content and get a shareable link. Saved items appeared in a "Recent Links" listing that anyone could browse.
• The researchers reported collecting around 80,000 saved entries, over 5 GB of data, spanning several years.
• The data reportedly included Active Directory credentials, code repository tokens, cloud provider keys, private keys and CI/CD secrets, some belonging to organizations in sensitive sectors.
• To test whether anyone was harvesting the listings, the researchers saved fake (canary) AWS keys. They reported that someone attempted to use those keys within about 48 hours.
• At the time of reporting, JSONFormatter's Recent Links page was reported as unavailable with saving disabled, while CodeBeautify's listing was reported as still reachable. Check each site's current state yourself rather than relying on this snapshot.

We have not independently verified the dataset. Figures above are as reported by the researchers and press coverage at the time.

Why this kind of exposure happens

Nothing about formatting JSON requires a server. The exposure came from a convenience feature layered on top: storing the input so it can be shared. Once a payload is stored server-side, its safety depends on details most users never see:

The same pattern has applied to paste sites and code playgrounds for years. Attackers monitor public listings because a fraction of what developers paste is live credentials.

If you ever saved JSON on these sites

1. Inventory. Search your browser history, chat logs and tickets for links to either site's saved or shared pages. Those links show what you stored.
2. Rotate every credential in those payloads. Cloud keys, database passwords, API tokens, webhook secrets, SSH or TLS private keys. Rotation means issuing a new secret and revoking the old one, not just changing where it is stored.
3. Review access logs for the period since the snippet was saved: AWS CloudTrail, GitHub audit logs, your identity provider and database logs. Look for unfamiliar IPs, new access keys or users, and unusual API calls.
4. Check personal data. If payloads contained customer data, involve your security or privacy team; depending on jurisdiction there may be notification obligations.
5. Request deletion from the site operator for anything you can identify, but do not treat deletion as remediation. Copies may already exist.

If you are a security or platform team

• Search the public listings (where still reachable) for your company domains, internal hostnames and key prefixes your organization issues, and rotate anything you find.
• Enable provider-side secret scanning and push protection on your repositories, and subscribe to cloud provider alerts for exposed keys.
• Publish an approved list of developer tools that process data locally, and block or warn on known paste and storage sites at the proxy if that fits your policy.
• Prefer short-lived credentials (for example role-based temporary credentials over long-lived access keys) so a leaked value expires on its own.

How to choose a formatter now

You do not have to give up online tools. Pick ones whose design makes this class of leak impossible rather than unlikely:

• Processing happens in the browser, verifiable by going offline or watching the Network tab.
• There is no server-side save feature and no public "recent" list.
• Share links, if any, keep the payload in the URL fragment so the server never receives it, ideally with optional encryption.
• The tool warns you about secrets before you share.

Our JSON formatter follows these rules: there is no server-side storage and no recent-links page, and share links scan for secrets first. The security page documents the architecture. Whatever tool you use, run payloads through a secret scanner before they leave your machine, and read how to format JSON without leaking API keys for a day-to-day routine.