Online code-formatting tools feel harmless. You paste in a blob of JSON, click a button, get prettier JSON back. What could go wrong? In November 2025, security researchers answered that question with a 5 GB dataset of other people's secrets. This article explains what happened, what was exposed, why it matters, and how to format JSON without taking the same risk.

What happened

On November 25, 2025, security research firm watchTowr Labs published findings showing that JSONFormatter.org and CodeBeautify.org — two of the most-trafficked online JSON tools — had been exposing user-pasted data through their "Recent Links" / "Save" features. The data was sitting on publicly accessible URLs that anyone could enumerate.

This was not a hack in the usual sense. The "leak" was the design: those tools let users save a formatted snippet to a shareable link, and the resulting pages were indexable. The feature worked exactly as built — it just happened to also be a public pipeline for everything anyone pasted.

The story was covered widely:

• The Hacker News
• SecurityWeek
• Help Net Security

What was leaked

watchTowr reported capturing over 80,000 files — roughly 5 GB. The contents included:

• AWS access keys and secrets, including credentials for AWS Secrets Manager itself.
• SSH private keys.
• Database connection strings with passwords.
• API tokens for SaaS services.
• Configuration files for production infrastructure.
• Internal API responses, sometimes containing PII.

Some of the data appeared to be years old — meaning it had been sitting on public URLs since at least 2020. Researchers were able to access it the same way anyone else could have.

Why this keeps happening

The root cause is structural. Any tool that offers a "share link" or "save" feature for arbitrary input must send that input to a server. Once it is on a server, it is one misconfigured access control away from being public. The pattern repeats across pastebin clones, screenshot tools, and formatter sites — and the data people paste into them tends to be exactly the kind they should never share.

The lesson is not "those specific sites are bad." It is "server-side processing of arbitrary user input is a leak waiting to happen."

How to format JSON safely

The fix is structural too: use tools that do not have a server to leak from.

1. Pick tools that process data locally. If the formatting happens in your browser, there is no upload step. The feature that caused the JSONFormatter.org leak simply cannot exist.
2. Verify it yourself. Open DevTools → Network. Paste data. Click Format. If you see a request carrying your payload, the tool is sending it somewhere. If you do not, it is local.
3. Default to redacting secrets anyway. Even with a client-side tool, get in the habit of replacing real credentials with placeholders before pasting. Defense in depth.
4. Avoid "share link" features on sensitive data. Even on tools you trust, treat any feature that creates a URL as a feature that publishes.

How JSON Formatter App is different

JSON Formatter App was built from the first line of code to do its work entirely in your browser. There is no backend that receives your JSON. There is no "save link" or "recent links" feature. The formatting, validation, schema checking, jq execution, and format conversion all happen locally — using the same libraries (Ajv, js-yaml, jq-wasm, quicktype) that production code uses, just packaged for the browser.

You do not have to take our word for it. Open our security page for step-by-step instructions to verify this yourself with your browser's Network panel.

What to do if you used the affected tools

If you have ever pasted a credential, config, or API response into JSONFormatter.org or CodeBeautify.org — especially before November 2025 — assume it was exposed. Practical next steps:

1. Rotate any credentials that may have been pasted: API keys, database passwords, SSH keys, cloud secrets. This is the most important step.
2. Audit cloud logs for the affected accounts for unexpected access.
3. Switch to a client-side tool for any future formatting of sensitive data.

Try the safe alternative

Every tool on this site runs 100% in your browser. No signup, no upload, no share-link feature to misconfigure. Start with the main editor or jump to a specific tool:

• Main JSON editor (format, validate, tree view, diff)
• JSON Schema validator
• jq playground (WebAssembly)
• JSON → YAML converter

Disclosure: this article summarizes publicly reported research by watchTowr Labs and third-party media coverage. The named tools may have changed their behavior since publication. Verify the current state of any tool before pasting sensitive data.