What not to paste into a JSON formatter

By Bruno J F Costa · Client-side processing is not a license to ignore judgment.

JSON Quiet formats and validates in your browser. The editor contents are not uploaded to JSON Quiet servers for beautifying. That architecture is described on the About page and in the Privacy Policy. It does not make the screen private. Anyone who can see your display, your screenshots, your ticket attachments, or a compromised browser extension can still see the paste.

This guide is about that remaining risk. It applies to this site and to every “free JSON online” tool that does send your body to a remote API. If you only remember one rule: treat a formatter like a whiteboard in an open office, not like a vault.

Never paste live secrets

Access tokens, refresh tokens, session cookies, API keys, Authorization header values
Private keys, client secrets, webhook signing secrets
Passwords, OTP seeds, recovery codes
Connection strings with credentials

Replace them with obvious placeholders: "Bearer REDACTED", "sk_live_xxx". Keep the shape of the JSON so you can still validate braces and commas. You do not need the real secret to learn whether a trailing comma is illegal.

Be careful with personal data

Customer payloads often include CPF, emails, phone numbers, addresses, and health or financial fields. Even if processing stays local, a screenshot in Slack or a “can you look at this?” email creates a copy you do not control. Redact names and identifiers. Use fake but well-formed examples when you ask for help on the Contact page.

Internal configs can be almost as sensitive: hostnames of staging databases, feature flags that reveal unreleased products, salary bands in a dump. If you would not pin it on a public wall, do not paste it into a tool you will later photograph.

Load from URL is still your fetch

The optional URL loader asks your browser to request a public resource. That is not “JSON Quiet’s server downloaded it.” It also means cookies for that host may be sent if you are logged in and the site allows the request. Prefer a public sample URL, or download the file yourself and open it locally after redacting.

Ads and logs are not the editor

Advertising scripts and hosting logs can see that you visited a page, not the JSON you typed. Do not confuse “the paste stays local” with “the web is anonymous.” Read the Privacy Policy if you need the exact split. Do not click ads to “support” the project; use PayPal or PIX if you want to tip.

A redaction workflow that still lets you debug