Skip to content
Tools

Security

Last updated:

The JSON formatter and its related tools are built so that we never receive your data. This page explains how, and how you can check it without trusting our word.

How your JSON is protected

  • Parsing, formatting, fixing, secret scanning and redaction run as JavaScript in your browser tab.
  • Your JSON is never included in network requests, analytics events, error reports, logs or URL query strings.
  • There is no server-side save feature and no public list of recent pastes.
  • Share links put the (optionally encrypted) data in the URL fragment after the #, which browsers do not send to the server.
  • Autosave uses your browser's local storage on your device only. "Clear all data" in the tool removes it.
  • JSON values are rendered as text, never as HTML, so a malicious string cannot run scripts on the page.
  • Loading from a URL is a direct request from your browser to that address; we run no proxy.

Verify it in the DevTools Network tab

  1. Open the JSON formatter and press F12 (or Cmd+Option+I on a Mac) to open DevTools.
  2. Select the Network tab and clear the existing entries.
  3. Paste JSON containing a unique word, such as {"check":"zebra-4821"}, then format, validate and scan it.
  4. Type the unique word into the Network tab's filter box, and check the payload of any request that appears. Your data should not be in any of them.

Offline test

Load the formatter once, then disconnect from the internet (or set DevTools Network throttling to "Offline") and reload. Formatting, validation, auto-fix and secret scanning keep working, which is only possible because no server is involved.

What we do not protect against

Browser extensions with access to all pages, malware on your device, and anyone you send a share link to can still see your data. Redact secrets before sharing, and treat a share link like the data itself.

Report a vulnerability

If you find a security issue, please email hello@wellsoftsolutions.com with steps to reproduce. Our contact details are also published in security.txt. See the privacy policy for how the rest of the site handles data.