Is it safe to paste an API response or config file into an online JSON formatter?

It depends entirely on that specific tool, not on JSON formatters as a category. Formatting valid JSON is just JSON.parse and JSON.stringify — there is no technical reason it needs a server. Whether a given tool actually keeps it local is something you can verify yourself in under a minute using your browser's Network tab, rather than trusting a privacy claim on the homepage.

How do I check if a web tool is sending my data to a server?

Open your browser's DevTools (F12 or Cmd+Option+I), switch to the Network tab, clear it, then paste your data and trigger the action (format, validate, whatever the tool offers). If nothing new appears in the request list, nothing left your browser. If a request does appear, click it to see exactly what payload was sent and to which domain. This works on any web-based tool, not just JSON formatters.

Does GetDevUtils' JSON Lab ever send my JSON to a server?

Formatting, minifying, and browsing the tree view are 100% local — JSON.parse and JSON.stringify running in your browser, no network request at all. Two features are the exception: "AI Repair" and schema validation (labeled "Run Validation" in the UI, without an AI flag), both of which send your JSON to Google's Gemini API to do their job. Neither runs automatically — both require a click — but only AI Repair's own label tells you what it's about to do; the validation button's name doesn't, which is exactly why checking the Network tab yourself beats trusting a button's copy.

Where Your JSON Actually Goes When You Paste It Into a Formatter

Published 4 Sep 2026 · 8 min read

"Runs 100% in your browser" is printed on the homepage of nearly every JSON formatter on the internet, including this one. It's also unverifiable from the homepage — a claim in marketing copy is not a network trace. The good news is you don't have to take anyone's word for it: whether a page sends your data to a server is something your browser already logs, for free, and checking it takes about a minute. This piece walks through how, and then does exactly that against GetDevUtils' own JSON Lab — including the one part of it that does leave your device, on purpose, behind a button that says so.

Quick answer: parsing and formatting JSON is just JSON.parse and JSON.stringify — both built into every browser, neither requiring a server. Any tool that only formats, validates, minifies, or lets you browse JSON as a tree can do all of that without a single byte leaving your machine, and most well-built ones do. The way to know for certain, for any specific tool, is your browser's Network tab — not the tool's own copy.

Check any tool yourself in under a minute

This works on literally any web page, not just JSON formatters, and it takes three steps:

Open DevTools — F12, or Cmd+Option+I on a Mac — and click the Network tab.
Clear the log (the 🚫 icon, or Cmd+K/Ctrl+L) so old page-load requests don't confuse the picture, then leave the panel open.
Paste your data and trigger the action — click Format, Validate, whatever the tool offers. Watch the request list. Nothing new appearing means nothing left your browser. Something appearing means click it: the Headers tab shows which domain it went to, and the Payload/Request tab shows exactly what was sent.

That's the whole method. It doesn't require trusting a privacy policy, reading source code, or taking a vendor's word for anything — the browser already logs every request it makes, and DevTools just shows you the log.

A URL that doesn't say "api" isn't proof of anything. Plenty of tools that upload your data do it via a background fetch() or XMLHttpRequest call that never changes the address bar at all. The only reliable signal is the Network tab itself, not the URL you're looking at or how the site describes itself.

What actually happens when you click Format in JSON Lab

Run the check above against JSON Lab's core actions — Format, Minify, and the tree view — and the Network tab stays empty. That's not a coincidence or a tuned demo; it's what the code underneath actually does. The formatter is two built-in JavaScript calls:

const parsed = JSON.parse(targetText);
const formatted = JSON.stringify(parsed, null, minify ? 0 : 2);

There's no fetch, no XMLHttpRequest, nothing reaching outside the tab. The tree view that lets you expand, filter, and copy a path from a parsed object works the same way — it's rendering the same in-memory object the parse step already produced, entirely client-side. This is also why JSON Lab (and any similarly built formatter) still works with your network connection off once the page has loaded: there's nothing for it to talk to.

The honest exception: two buttons that do leave your device

JSON Lab also ships two AI-assisted features, and unlike Format and Minify, both of them send your JSON to a server — specifically, to Google's Gemini API. This is the part a purely marketing-driven privacy page tends to leave out, so it's worth being exact about what triggers it — including where the labeling itself falls short.

Action	Where your data goes	Triggered by
Format / Prettify	Nowhere — `JSON.parse`/`JSON.stringify` in-tab	Automatic, on every edit
Minify	Nowhere — same local call, no whitespace	Clicking Minify
Tree view / path copy	Nowhere — renders the already-parsed object	Automatic, on valid input
AI Repair	Google's Gemini API (`generativelanguage.googleapis.com`), to auto-fix broken syntax	Clicking the "AI Repair" button
Schema validation (schema mode)	Google's Gemini API, to compare your JSON against your schema and write a report	Clicking "Run Validation 🛡️"

Both features are opt-in in the sense that matters most — neither fires from typing or formatting, both require a click, and if you never click either one, nothing you paste into JSON Lab reaches a server at all. But they aren't equally honest about it. AI Repair says exactly what it is in its own label. The schema-validation button, in the actual shipped UI, is not called "Validate Schema" or anything AI-flagged — it reads "Run Validation 🛡️," shield emoji included, which if anything signals the opposite of "this uploads your data." Someone who'd never click a button called "AI Repair" on a payload with a real secret in it could still click "Run Validation 🛡️" without a second thought, because nothing in that label tells them Gemini is about to see the same payload. The Network tab doesn't care what a button is named, which is exactly why it's the check worth running instead of trusting either button's copy.

See it for yourself

Open JSON Lab with DevTools' Network tab open. Paste any JSON and click Format — empty log. Then switch to Schema mode, add any schema, and click "Run Validation 🛡️" — a request to Google's API appears, with no "AI" anywhere in the button you clicked. Same page, and now you've confirmed the gap between the label and the behavior yourself instead of reading it here.

Why this is worth checking, not just trusting

The reason to actually run the Network-tab check rather than skim a privacy paragraph: the things people paste into a JSON formatter are frequently not sample data. A production API response can carry a live session token. A config dump can carry a database password or a third-party API key. A debugging session can carry a real user's PII, copied out of a support ticket. None of that is hypothetical — it's the ordinary contents of the "here's the JSON that's failing" clipboard most developers paste several times a week. A formatter that quietly POSTs that payload to its own backend for logging, analytics, or "AI insights" has now put that token, password, or PII on a server you didn't choose to trust with it, whether or not the tool's about page mentions it.

This is also the gap the "unexpected token" piece and the JWT signature piece both lean on without spelling out: half the point of debugging a broken payload or a failing token locally, instead of pasting it into a chat window or a random online tool, is that the payload usually contains something you'd rather not hand to a third party at all. A local-only formatter makes that a non-issue for the 95% of the workflow that's just parsing and formatting; it's still worth confirming which 5% isn't, on any tool, including this one.

What to actually check before you trust a formatter

Run the three-step Network-tab check above against the specific action you're about to use — not the tool in general, since a tool can be local for formatting and networked for an "AI" feature at the same time, as JSON Lab is.
Don't trust a button's own name as disclosure. JSON Lab's "AI Repair" says what it does; its schema-validation button, "Run Validation 🛡️," doesn't mention AI or a server at all despite sending the same payload to Gemini. A label is marketing copy for a feature, not a guarantee about where your data goes — the Network tab is the only check that isn't.
If a request does fire, read its destination domain, not just whether one fired. A request to the tool's own domain (analytics, error logging) is a different risk than one to a third-party AI API carrying your actual payload.
Don't assume "offline-capable" or a PWA install icon means offline-only — a page can cache its own assets for offline use while still calling out to an API when you click a specific button and you're back online.
Re-check after a redesign. Nothing stops a tool from adding a server-side feature in a future release; the claim on this page is accurate as of today's code, and the same three-step check is how you'd catch it if that ever changed.

📋 Format your JSON without the guesswork

JSON Lab parses, formats, minifies, and lets you browse JSON entirely in your browser — verify it yourself with the Network tab in under a minute. The two AI features are there when you want them and never run without a click, even where their own labels don't say what they do.

Open JSON Lab →

← Back to Blog