Is it safe to paste JSON, a JWT or an API key into an online tool?
Only if the tool never stores or sends what you paste, and even then, strip real secrets first. In 2025, two popular formatters were found to have exposed more than 80,000 pasted snippets. Here is how that happens, and how to check a tool before trusting it.
Updated 3 min read
The tool this guide uses
Ready. Runs locally on your device.
Your files stay on your device. The tool works directly in your browser, using your device to process your files. Nothing is sent to our servers, and we never receive, store, or see your files or figures.
What happened in 2025
In November 2025, the security firm watchTowr published research, reported by BleepingComputer and Help Net Security, showing that JSONFormatter and CodeBeautify had exposed more than 80,000 saved snippets through their save and share feature. The shared links followed a predictable pattern, so anyone could walk through them.
What was in them is exactly what developers paste into formatters: Active Directory credentials, cloud access keys, private keys, CI/CD secrets, API responses full of personal data, from organisations in government, banking, healthcare and security. The researchers planted fake keys and saw others trying them within days. Both sites disabled saving afterwards.
Nobody broke in. A convenience feature did what it was built to do, and the copies it kept turned public.
Four ways a pasted secret leaves your hands
A tool does not have to be malicious to leak what you give it. These are the usual routes:
- Save and share features. Anything a tool can save, it stores somewhere, and links can be guessed, listed or indexed.
- Server-side processing. If the formatting happens on a server, your input crosses the network and may be logged along the way.
- Analytics and error reporting. Some pages send what is typed, or the page state around an error, to third-party services.
- Browser extensions. An extension with access to every page can read what you paste into any of them.
The first three are properties of the tool. The fourth is a property of your browser, and it is worth reviewing which extensions can read all sites.
How to check a tool in two minutes
- Open the tool and your browser’s developer tools, and switch to the Network tab.
- Clear the list, then paste something harmless and use the tool.
- Watch for requests. A tool that works locally makes none. One that sends your input will show a request carrying it.
- For a stronger test, load the page, switch off your connection, and use it again. A tool that still works cannot be sending your input anywhere.
Habits that protect you whatever the tool
- Strip secrets before you paste. What you usually need formatted is the structure, not the values. Replace tokens, keys and passwords with placeholders.
- Prefer a local tool. Your editor formats JSON with a keystroke. When it is not to hand, use a tool you have checked, such as the one above.
- Never paste a live production token. Decode test tokens, or tokens that have already expired.
- Rotate on doubt. If a real secret went somewhere you cannot vouch for, change it.
The tools here
The JSON formatter above, the JWT decoder, Base64, hashing and URL encoding all work inside your browser, with no save links and no server behind them. The JWT decoder deliberately offers no way to share its output, since a decoded token is usually a credential.
Common questions
Is a JWT a secret?
A JWT is signed, not encrypted, so anyone holding it can read what is inside, and anyone holding a valid one can use it until it expires. Treat a live token like a password: never paste it into a tool that could keep it.
What should I do if I pasted a live secret somewhere?
Assume it is exposed. Rotate the key or password, revoke the token, and check the service's logs for use you do not recognise. Do it now rather than after confirming a leak, because the check can take longer than the damage.
Does this JSON formatter store what I paste?
No. It has no save or share feature and no server behind it. The JSON is parsed and printed by your browser. You can confirm it by watching the Network tab in your browser's developer tools while you paste: no request is made.
Cite
Cite this page
Reembun. (2026, September 11). Is it safe to paste JSON, a JWT or an API key into an online tool?. https://reembun.com/guides/is-it-safe-to-paste-secrets-into-online-tools
About Reembun
Reembun is a free collection of more than 100 online tools for PDFs, images, video, audio, text and everyday calculations. Every tool runs inside your browser, so your files are processed by your own device and are never uploaded to a server. There is nothing to install, no account to create, and no watermark on what you make.
You do not have to take our word for it. Open your browser’s developer tools, watch the Network tab, and use any tool: your file never appears there.
Reembun is built and run by PT RHP Cipta Digital, a registered company in Indonesia.
