Is it safe to paste JSON into an online viewer?

What really happens to your data in a web tool, how to tell an upload from local work, and when to say no.

Updated 2026-11-04 · 6 minute read

You have an API answer with a customer's name, email address and order history. You want to read it, so you reach for an online JSON viewer. Should you paste it?

The honest answer is: it depends on the tool, and most tools do not tell you. This page shows how to find out in thirty seconds.

Two kinds of web tool

A tool that works on your machine. The page is a set of files your browser downloads. Your data goes into the memory of the tab and nowhere else. When you close the tab, it is gone. The server never sees the data and cannot be made to hand it over, because it never had it.

A tool that uploads. Your text is sent to a server, processed there, and sent back. The server can log it, cache it, keep it, or be breached later. The page usually looks exactly the same.

You cannot tell them apart by looking.

How to check in thirty seconds

1. Open the developer tools of your browser, with F12 or Ctrl+Shift+I.
2. Open the Network tab.
3. Clear the list.
4. Paste your JSON and press the button you want to use.
5. Look at the list.

If the tool works on your machine, you see nothing new, or only requests for advertisements and measurement that carry no part of your data. If the tool uploads, you see a POST or a PUT, and the request body holds your text.

A second check: turn off the network and reload. A tool that works on your machine keeps working. An uploader fails.

Do both checks once for any tool you intend to use with real data.

What to look for in the privacy policy

A tool that works on your machine can say so plainly. Look for a sentence such as "the data never leaves your browser". If the policy instead explains how long files are kept, how they are encrypted on the server, or that they are deleted after an hour, the tool uploads. Deleting after an hour is better than keeping it, but it is still an upload, and your rules at work may not allow it.

Be careful with the word "secure". A connection can be perfectly secure and still carry your data to somebody else's computer.

When to say no

Do not paste into any online tool, even one that works on your machine, if:

• The data holds credentials, API keys or tokens. Those must be rotated, not inspected.
• Your employer forbids it. Many companies do, and the rule usually covers every web tool, not only the ones that upload.
• The data is covered by a rule such as HIPAA, PCI DSS or a data protection agreement with your customer. Read the agreement before you decide.

In those cases use a tool on your own machine: jq, python -m json.tool, or the JSON viewer inside your editor.

A middle way: remove the sensitive part first. The shape of the data is usually what you need to see, not the values.

jq '[.users[] | {id, createdAt}]' real.json > safe.json

What this tool does

The whole tool is a set of static files. There is no account and no upload path in the code.

• Your document stays in the tab. It is read, formatted, searched, compared and checked inside a worker in your browser.
• The advertisements never see it. The advertisement code runs in the page. The document is held in a separate worker and is never put into the address, a cookie or a request.
• It works with no network. Load the page once, turn off your connection, and every action still works. That is the strongest proof there is.
• Two actions do use the network, and only when you ask. Load URL makes your browser fetch an address you typed. Share puts the document in the part of the link after the #, which a browser never sends to a server.

The privacy page says all of this in full, including what the advertisements and the measurement do collect, which is the ordinary information any site collects.

A note on the share link

The Share action compresses your document and puts it inside the link. No server ever receives it. But the link is the data. Anybody who has the link has the document.

So treat a share link the way you would treat the file itself. Do not put one in a public issue tracker, a chat channel with many people, or a page that a search engine can read.

The short version

Read next