JSON formatter and validator that keeps your data in the browser
Format, validate and explore JSON without uploading it. Errors name the actual problem with an exact line and column, duplicate keys are reported instead of silently dropped, and anything that looks like a credential is flagged before you copy or share the document.
How to use it
- Paste or drop a JSON file into the panel above. It validates as you type.
- If it is invalid, the error names the specific problem and marks the exact character. Click Put the cursor there to jump straight to it.
- Switch between Tree, Formatted and Minified. In tree view, hover any node to copy its JSONPath.
- Format (F) or Minify (M) rewrites the input in place. Sort keys orders keys alphabetically at every level.
Why the errors are more useful here
JSON.parse reports nearly every syntax problem as some variant of
Unexpected token, and the position it gives differs between browsers. This
validator parses JSON itself, so it can say what is actually wrong. Common cases:
| What you wrote | What this reports | Why |
|---|---|---|
{"a": 1,} | Trailing comma — JSON does not allow a comma before } | JSON has no trailing commas, unlike JavaScript object literals. |
{'a': 1} | JSON keys use double quotes, not single quotes | Single quotes are valid JavaScript but not valid JSON. |
{a: 1} | Unquoted key "a" — JSON keys must be double-quoted | Bare identifiers as keys are a JavaScript feature, not a JSON one. |
{"a": "x | Unterminated string — no closing quote | Usually a truncated copy-paste or an unescaped quote inside the value. |
{"a": "x y"} | Raw tab inside a string — it must be escaped | Control characters below U+0020 have to be written as \t, \n and so on. |
01 | Numbers may not have a leading zero | JSON numbers have no octal form; write 1. |
NaN | JSON has no NaN or Infinity — use null or a string | Both are JavaScript values with no JSON representation. |
{"a": 1 | Unclosed object — expected } | A missing closing brace, often after an edit near the end of a file. |
{"a":1,"a":2} | Valid, but reported as a duplicate key | JSON.parse keeps the last value and discards the first without complaint. |
The credential scanner
Configuration files are full of secrets and nobody stops to check before pasting one into a formatter. In November 2025 security researchers at watchTowr disclosed that two of the most popular online JSON formatters had exposed more than 80,000 saved pastes — over 5 GB — through a publicly browsable list of recent links. The exposed material included live AWS credentials belonging to a stock exchange's security systems, Active Directory and database passwords, private keys and KYC data. Honeypot credentials planted by the researchers were probed by attackers within 24 to 48 hours.
This tool saves nothing, so it has nothing to expose. It also looks at what you pasted and tells you what it found:
- AWS access key IDs and session tokens
- GitHub, Slack and Google API keys
- Stripe live keys and OpenAI-style keys
- Private key blocks (
-----BEGIN … PRIVATE KEY-----) - JSON Web Tokens and bearer tokens
- Connection strings with an embedded password
- Any real-looking value under a key named
password,secret,token,api_keyand similar
Placeholders such as changeme, <your-password>
and ${DB_PASSWORD} are ignored, so the warning means something when it
appears. Redact them replaces every finding while leaving the document's
structure and every other value untouched.
Tree view and JSONPath
The tree collapses and expands at any level and shows how many keys or items
each node holds. Hovering a node reveals its JSONPath — $.database.pool.max
— which you can copy straight into a query, a test, or a ticket. The stats line
reports node count, nesting depth and document size, which is often the fastest
way to find out why an API response is slow.
Frequently asked questions
Is it safe to paste production JSON here?
Safer than anywhere that uploads it. Formatting and validation happen entirely in your browser, and the Content-Security-Policy sets connect-src 'none', so the page cannot send your data anywhere even if it tried. In November 2025 two of the most popular online formatters were found to have exposed more than 80,000 saved pastes, including live AWS credentials. This tool has nothing to expose because it saves nothing.
Why does it warn me about credentials?
Because config files are full of them and people rarely stop to check. The scanner looks for AWS keys, GitHub and Slack tokens, Google and Stripe API keys, private key blocks, JWTs, bearer tokens and connection strings with embedded passwords, plus any real-looking value under a key named password, secret, token or api_key. Placeholders like changeme or ${DB_PASSWORD} are ignored. One click redacts every finding while keeping the document's structure.
What does 'Unexpected token' actually mean?
In most tools, very little — it is what JSON.parse says for almost every syntax error. This validator parses JSON itself specifically so it can tell you the real problem: a trailing comma, a single-quoted key, an unquoted key, an unterminated string, a raw tab inside a string, or a number with a leading zero. It reports the exact line, column and character.
Why does it report duplicate keys?
Because JSON.parse silently keeps the last value and discards the earlier ones, so a duplicated key produces a document that parses cleanly and behaves differently from what you intended. It is a common and hard-to-spot config bug. Almost no online formatter reports it.
Does formatting change my data?
No. Formatting only changes whitespace. Sorting keys reorders them without altering any value, and minifying removes whitespace only. The parsed value is identical in every case.
Can I share formatted JSON with someone?
Yes, and the document travels in the URL fragment rather than through a server. Check the credential warning before you send a link — the fragment stays private in transit, but whoever receives it can read everything in it.