I used to treat online JSON formatters like sticky notes. Paste, format, copy, close the tab. Then one day I realized the payload I had just cleaned contained an internal webhook URL and a temporary token. The tool worked fine. The data was also sitting on someone else’s server for an unknown amount of time.
Most free formatters are convenient. They are also usually thin frontends over a backend that receives your text, runs a library, and returns the result. That is fine for public examples. It is less fine for API responses that include credentials, customer data, or internal hostnames.
Client-side tools avoid that step entirely. The browser already has a JavaScript engine. A well-written formatter can parse, indent, and validate using only the code that loaded with the page. Nothing is posted. Refreshing the tab wipes the data. That property matters more as soon as the JSON stops being toy data.
The same pattern shows up with other small developer utilities. Regex testers, Python playgrounds, and simple code formatters all exist in both server-backed and fully local versions. The local ones are slightly less polished in some cases, but they remove an entire class of risk. You do not need to trust a privacy policy if the bytes never leave the machine.
A practical workflow I settled on:
- Keep a couple of bookmarked client-side tools for the daily tasks (JSON, regex, quick Python checks).
- Use them by default when the data is anything other than public sample code.
- Fall back to local CLI tools (jq, Python’s json.tool, or a simple editor plugin) when the file is large or the environment is locked down.
- Only use a server-side service when I explicitly want the feature that requires a server, and only with data I would be comfortable seeing in logs.
The quality bar for these small tools has risen. Tree views, error highlighting on the exact line, diff modes, and offline support are now common in the better client-side versions. They are no longer the crude “paste and hope” pages from a few years ago.
If you regularly handle JSON from production systems, the five seconds it takes to switch to a local formatter is cheaper than the cleanup if something sensitive ends up in the wrong place. The same logic applies to any online tool that asks for code or data you did not write for public consumption.
Most of the time the answer is not “never use online tools.” It is “know which ones keep the work inside the browser and default to those.” That single habit removes more risk than any privacy setting you can toggle after the fact.
Top comments (0)