I stopped pasting API responses into online JSON formatters — here's the 30-second audit I run instead

In November 2025, watchTowr Labs disclosed that CodeBeautify.org — one of the largest developer-tool sites on the internet — had been exposing user-pasted data through a public "Recent Links" feed. Not a hypothetical: API keys, SSH private keys, and cloud credentials that developers pasted in to "just format this quickly" were reachable by anyone who knew where to look.

If you've ever pasted a production payload into an online formatter, this one's for you.

The uncomfortable truth about "online tools"

Most web-based formatters are not actually processing your data in your browser. Many POST your payload to a backend, format it server-side, and hand it back. Some store pastes to make "shareable links" — and shareable means enumerable.

We put together a full technical breakdown of what happened, what was exposed, and the mechanics behind it:
The CodeBeautify data leak, explained

The 30-second audit (run this on any web tool)

Before trusting any online tool with a real payload:

1. Open DevTools → Network tab, filter to Fetch/XHR
2. Clear the log
3. Paste your JSON and hit format
4. Watch the network panel

Any request whose payload contains your data = it left your machine. Doesn't matter what the landing page says about privacy. The network panel doesn't lie.

Second check: load the page, turn off Wi-Fi (or use DevTools' offline throttling), and see if the tool still works. A genuinely client-side tool keeps working with zero connectivity. One that "phone home" dies on the spot.

What a real client-side pipeline looks like

For the past year I've been using JSON Formatter App precisely because you can do this audit on it and come up clean — after the initial page load, everything runs in the browser: formatting, validation, transforms, the lot. No account, no cookies required, paste and go.

The parts I actually use daily:

• Validation that names the error. Chrome 114+ changed how V8 reports JSON syntax errors, which silently broke a bunch of tools that parsed V8's error strings. A scanner written against the spec instead survives browser updates, and gives you plain-English errors with exact line/column plus jump-to-error: why JSON validators should name the error
• Real jq in the browser. Not a jq-lookalike — actual jq compiled to WebAssembly: map, select, sort_by, group_by, object construction, with live preview as you type: jq + JSONPath transform panel
• One-click auto-repair for the trailing-comma / single-quote / comment mistakes we all make when hand-editing config

And if you want the general checklist for evaluating whether a formatter is safe to use with sensitive payloads — the offline test, the network audit, what to look for in the privacy policy: what makes a JSON formatter actually secure

The habit worth keeping

It's not "never use online tools" — it's know which tier of data you're pasting:

• Never: credentials, tokens, customer data, anything from prod → local tool or editor only
• Gray zone: internal payloads, staging responses → only tools that pass the network audit
• Fine: public API samples, tutorial snippets, your kid's Minecraft JSON → whatever's fastest

The CodeBeautify leak wasn't malice — it was a "shareable links" feature meeting real-world data. Every tool with a paste box and a server is one config change away from the same outcome. Audit before you paste, not after.

Full disclosure of the incident and what was exposed: CodeBeautify data leak explained — and yes, run the audit on our tool too. That's the point.