· 6 min read
The honest answer is: it depends entirely on whether the tool sends your text to a server, and most people never check. It is worth checking, because of what JSON usually contains.
Nobody formats a toy object. The JSON people paste into a formatter is almost always something they are debugging, which means it is a real API response or a real config file. That routinely includes bearer tokens and API keys, session identifiers, customer email addresses and phone numbers, internal database IDs, webhook secrets, and the shape of a private API you would not publish.
A pasted access token is a live credential until it expires. If it went to a third-party server, you cannot un-send it, and the right response is to rotate the key rather than to hope.
A server-side formatter POSTs your text, formats it on a machine you do not control, and sends it back. A browser-side formatter parses the text with the JavaScript already running in your tab. Both look identical: a box, a button, formatted output.
You can tell them apart without trusting anyone's marketing. Open the tool, load the page, then disconnect from the internet and try it. A browser-side tool keeps working. A server-side one cannot. The other way is to open your browser's network panel and watch whether a request goes out when you press the button.
Everything here runs in the tab. Prettifying, validating, comparing and converting are all done by JavaScript already loaded in the page, so nothing is transmitted and there is no server log to appear in. That is verifiable by the offline test above rather than something you have to take on faith.
A cloud tool promising to delete your data after an hour may be entirely sincere. But it is a promise about behaviour, and it depends on their retention working as described, their backups expiring, and their logs not capturing the payload separately. A local tool makes no promise because it never received anything. That is a different category of assurance, and it is the only one worth relying on for a credential.
No. Parsing and formatting happen in your browser tab. Load the page, disconnect from the internet, and it still works.
Open the browser network panel before pressing the button, or load the page and then go offline. A browser-side tool keeps working; a server-side one stops.
Rotate the key. You cannot verify what a third party retained, and rotating is quick and removes the question entirely.
No imposed limit. Because the work happens in memory, very large documents are bounded by your device rather than by a quota.