A private alternative to JSONFormatter and CodeBeautify

By Uxair Ijaz · 2026-11-01 · 6 min read

Most of us paste JSON into an online formatter several times a week: an API response, a config file, a log line. That JSON often holds things that should never leave the company: tokens, connection strings, customer records. This article compares two of the most popular formatters, JSONFormatter.org and CodeBeautify, with the JSON formatter on InTab, and explains what to check in any tool you paste into.

Disclosure: InTab is our site. Facts about the other tools come from their own pages and from the published research linked below, checked on 1 November 2026.

What happened in November 2025

In November 2025 the security firm watchTowr published research showing it had collected more than 80,000 saved JSON entries from JSONFormatter and CodeBeautify. The entries included Active Directory credentials, cloud and database keys, private keys, GitHub tokens, CI/CD secrets and personal data, from organisations in government, banking, healthcare, telecoms and cybersecurity.

The cause was not a hack. Both sites have a Save button that stores your JSON on their server and gives you a shareable link. Saved links were listed on a public Recent Links page, and the link addresses followed a predictable pattern. To test whether anyone was watching, watchTowr saved fake AWS keys; someone tried to use them within 48 hours.

After the report, JSONFormatter disabled saving and hid Recent Links; CodeBeautify's Recent Links remained reachable at the time (Help Net Security, Security Affairs). As of 1 November 2026, both sites show Save and Recent Links in their menus again, and JSONFormatter's save dialog says that data saved without logging in "will become public".

Formatting itself was never the problem. The risk comes from a feature that sends your text to someone else's server, and from defaults that make it public.

Side by side

✅ yes · ⚠️ partly · ❌ no. Based on each site's own pages on 1 November 2026.

Where JSONFormatter and CodeBeautify are stronger

To be fair to them, both are mature sites with a long list of tools beyond JSON: dozens of converters, viewers and generators, years of history and a large user base. Sharing a link is useful when you want a colleague to see the same document, and logging in gives you a private list of saved links. If you never press Save and never paste secrets, they work well.

How InTab handles your JSON

The JSON formatter runs entirely in your browser tab. There is no Save-to-server button, no link list and nothing to log in to, so there is nothing that can become public.

You do not have to take that on trust:

• The browser enforces it. Every page is served with a Content Security Policy that allows network requests only to the site itself and two named services (OCR language downloads and page-view counts), so a script on the page could not send your JSON to anyone else even if it tried. The privacy page explains the exact rule.
• You can watch it. Open your browser's developer tools, go to the Network tab, paste some JSON and format it. No request carries your JSON.
• It works offline. Format something once so the page is fully loaded, then disconnect from the internet: it keeps working.

Broken JSON is repaired, not rejected

Most JSON people paste is not quite valid: copied from a log, cut off at the end, written by hand. Instead of stopping at the first error, the formatter repairs the input and tells you it did, with an Auto-fixed chip that lists what changed. It:

• adds missing closing brackets and braces, and removes extra ones;
• removes trailing commas and adds missing ones;
• quotes unquoted keys and turns single quotes into double quotes;
• drops comments and Markdown code fences;
• cuts the JSON out of a log line, so 2026-11-01 10:42:07 INFO response={"id": 7, "ok": true} formats as the object alone;
• unwraps escaped or stringified JSON such as "{\"id\":1}".

If the text is not JSON at all, it says so, with the line and column, instead of inventing a result. The JSON validator is there when you want strict checking with no repairs.

Beyond formatting

• JSON to Code generates types for TypeScript, C#, Java, Python, Go, Kotlin, Swift, Rust, PHP and Dart.
• JSON to YAML, XML to JSON and the data converter move between JSON, YAML, XML, CSV and TOML.
• Diff Finder compares two JSON documents line by line.
• The JWT decoder reads tokens without sending them anywhere, which matters as much as it does for JSON.

Which one should you use?

• Pasting anything from work (API responses, configs, logs, tokens): use a formatter that never sends your text to a server. That is what InTab is built for.
• Sharing a formatted document with someone: a share link is convenient, but log in first, set a short expiry, and never share anything containing secrets. Pasting into your team's chat or a private gist is usually safer.
• Already saved secrets on a formatter: treat them as leaked. Rotate the keys and passwords, then delete the saved links.

What to check in any online formatter

1. Does it have a Save, Share or Permalink button? If so, your text can be stored on a server.
2. Is there a public list of recent or popular documents?
3. Does the Network tab show a request when you format? Some online tools send your text to a server to format it.
4. Does it still work with the internet switched off?

A tool that passes all four keeps your data on your machine. One that fails any of them may be fine for public data, but not for anything you would not post on a public forum.