CodeBeautify.org is one of the largest developer-tool sites on the internet — a sprawling collection of hundreds of online converters, formatters, and validators that, between them, attract millions of visitors a month. It is also the sibling site of JSONFormatter.org, and in November 2025 both were at the center of the same disclosure: a publicly indexable "Recent Links" feature had been leaking user-pasted data for years.

This article is the technical companion to our JSONFormatter.org breach write-up. It focuses specifically on CodeBeautify: what the feature was, why it leaked, how big the dataset was, and what developers should take away from it.

What CodeBeautify.org is

Where JSONFormatter.org is a focused JSON pretty-printer, CodeBeautify is a general-purpose code-formatting mall — JSON, XML, YAML, CSV, Base64, JWT, SQL, HTML, CSS, every popular language. Third-party ranking services (Similarweb) place it in the same global traffic tier as the major programming reference sites, with a Programming-category ranking in the low hundreds.

Both CodeBeautify.org and JSONFormatter.org share ownership and infrastructure, including the "Save" feature that turned out to be the source of the leak. That is why the November 2025 disclosure hit both sites simultaneously.

The root cause: a feature, not a bug

The leak was not the result of a sophisticated intrusion. It was the direct, intended behavior of a feature called "Save" (also surfaced as "Recent Links" / "Public Links"). The flow was:

1. User pastes content (any content — JSON, an env file, a private key) into a CodeBeautify tool and clicks Save.
2. The site POSTs the content to its backend and stores it under a short, predictable URL — typically keyed off a short ID.
3. The site returns a "shareable link" so the user can send the formatted result to a colleague.
4. That link is publicly readable by anyone who has or guesses the URL, and the IDs were enumerable.

In other words: CodeBeautify was operating, by design, as a public pastebin — except the people pasting into it largely did not realize that. They thought they were using a formatter. The "shareable link" was presented as a convenience, not as a publication.

The scale

Researchers at watchTowr Labs reported capturing more than 80,000 files totaling roughly 5 GB from the combined JSONFormatter.org and CodeBeautify.org datasets. Some of the files dated back several years, which means the exposure window was not a few days — it was years of accumulated user input.

What was in the data

The leaked content read like a security audit gone wrong. watchTowr documented:

• Cloud credentials. AWS access keys and secrets — including, in at least one case, credentials with permissions to read AWS Secrets Manager itself, which would have allowed pivoting into a much larger secrets store.
• SSH private keys. The kind of file you would normally only ever have on disk inside a hardened bastion host.
• Database connection strings with embedded usernames and passwords, in some cases pointing at production databases.
• API tokens for SaaS services — payment providers, internal CI systems, observability platforms.
• Production configuration files for infrastructure-as-code, container orchestration, and deployment pipelines.
• Internal API responses, some of which appeared to contain personally identifiable information.

watchTowr noted that affected organizations spanned banking, government, and large technology companies — meaning the people pasting were not hobbyists, they were employees with access to sensitive production systems.

Media coverage

The disclosure was widely reported. Some of the more detailed pieces:

• The Hacker News — "Years of JSONFormatter and CodeBeautify Data Exposed"
• BleepingComputer — "Code beautifiers expose credentials from banks, gov't, tech orgs"
• SecurityWeek — "Thousands of Secrets Leaked on Code Formatting Platforms"
• TechRadar — "Top code formatting sites are exposing huge amounts of user data"

Why this is not a one-off

The CodeBeautify leak is the latest instance of a pattern that has hit pastebin clones, screenshot tools, in-browser PDF converters, and other "just paste it here" services over the years. The pattern is always the same:

1. A tool offers a convenience feature that requires sending user input to a server.
2. The server stores the input under a URL.
3. The URL is public, or becomes public through misconfiguration, enumeration, or a forgotten feature.
4. Years of accumulated data is exposed.

The lesson is not "CodeBeautify is uniquely bad." It is that any tool that ships your input to a server for a "convenience" feature is one access-control bug away from the same outcome. The defensive posture is architectural, not reputational: prefer tools that do the work locally, so the leak-class cannot exist.

What to do if you used CodeBeautify for sensitive data

If you have ever used CodeBeautify.org's Save / share feature on anything containing credentials, internal config, or customer data — especially before November 2025 — assume it was exposed. The remediation is standard post-incident hygiene:

1. Rotate affected credentials immediately. New API keys, new database passwords, new SSH keys, new cloud secrets. Treat this as the single highest-priority action.
2. Audit access logs on the affected accounts for the entire exposure window. Look for access from unfamiliar IPs, regions, or user agents.
3. Check cloud-provider secret-scanning alerts (GitHub Secret Scanning, GitGuardian, AWS Detector, etc.) — if any of your leaked credentials were of a type those services fingerprint, they may already have flagged public exposure.
4. Migrate to a client-side tool for future sensitive formatting. The goal is to never again have a paste leave your machine.

How JSON Formatter App avoids this entire class of problem

We built this site as the structural answer to leaks like CodeBeautify's. There is no backend that receives your JSON, no Save feature that creates a public URL, no database of pastes to enumerate. The formatting, validation, schema checks, jq execution, and format conversion all run inside your browser tab using libraries you can inspect.

You can verify this yourself in 30 seconds — open DevTools, switch to the Network tab, paste something, and click Format. You will see zero outbound requests carrying your data. Full instructions are on our security page.

The bottom line

The CodeBeautify leak was not a clever exploit. It was a feature that did exactly what it was designed to do — send user input to a server and publish it under a URL — combined with users who reasonably assumed they were using a local formatter. The fix is not to trust the next formatter more. It is to use a formatter whose architecture makes the leak impossible.

Disclosure: this article summarizes publicly reported research by watchTowr Labs and independent media coverage. CodeBeautify.org may have changed its behavior since the disclosure; verify the current state of any tool before pasting sensitive data into it.