JSON Tools

Almost every JSON tool on the web is a form that posts your document to a server. For a snippet from a tutorial that is fine. For the actual payload you are debugging it is rarely fine at all: production JSON tends to carry access tokens, customer records, internal hostnames and account identifiers, and pasting it into an unknown endpoint hands all of that to somebody else’s access log. In a regulated environment it is not a judgement call, it is a reportable incident.

The tools here take the server out of the question entirely. The page you load is static HTML and JavaScript; when you paste a document, it is parsed by code already running in your tab. There is no request to inspect and no endpoint to trust, which is a much stronger position than a promise not to look.

That decision also makes them faster. There is no upload, no queue and no round trip, so a 2 MB document formats in the time it takes to repaint rather than the time it takes to cross the Atlantic twice. And it means they work on an aeroplane, on a locked-down corporate network, and inside a VPN that blocks everything it does not recognise.

The engines are written by hand rather than assembled from packages, which matters more than it sounds. The parser is iterative rather than recursive, so a deeply nested document reports an error instead of blowing the JavaScript call stack — there is a test in the suite that feeds it twenty thousand levels of nesting. Every key that comes from your document is assigned through an own-property guard, so a payload containing __proto__ cannot alter the behaviour of the page that is inspecting it. These are not theoretical concerns; they are the two ways JSON tools actually break.

Where a standard exists, it is followed exactly: RFC 8259 for the grammar, RFC 6902 for patch documents, RFC 7386 for merge patches, and JSON Schema Draft 2020-12 for inference and validation. When a tool has to make a choice the standard leaves open — how to match array elements when comparing, whether to sort keys on output — it is exposed as a setting rather than hard-coded, and the reference table on each page says what the setting does at the edges.

If you are not sure where to start: JSON Validator for a document that will not parse, JSON Diff for two documents that should match and do not, JSON Formatter for something unreadable, and Schema Generator when you need to describe the shape of a response you did not write.