JSONFormatter & CodeBeautify: What Was Reported

Published July 25, 2026By Samson PG

Three independent outlets reported that two widely-used JSON tools stored what you pasted, on a guessable public URL, for years. Here's a summary of that reporting, with sources, and what a no-upload tool changes structurally.

This post summarizes third-party security reporting — it isn’t original research. In November 2025, three independent outlets (The Hacker News, BleepingComputer, and Security Affairs) reported that security researchers had found JSONFormatter.org and CodeBeautify — two of the most widely used online JSON tools — exposing user data for years through a “Recent Links” feature. Below is what was reported, with links to each source so you can read the original coverage yourself.

What was reported

According to The Hacker News, both sites let users save a formatted JSON snippet and get back a shareable URL — a normal, useful feature. The reported problem: those URLs followed a predictable, guessable pattern, which let researchers walk the ID space and pull down more than 80,000 saved pastes totaling over 5GB sitting publicly accessible with no authentication required.¹

Per BleepingComputer’s reporting, what was found in them included live passwords, cloud API keys, authentication tokens, and internal configuration data — submitted by people who had pasted a JSON response or config file to format it, not expecting it to be saved, indexed, and left reachable by anyone with the URL pattern. The outlet reported affected organizations spanning banking, government, critical infrastructure, healthcare, and telecom.²

Security Affairs reported that both companies disabled the save/share feature after disclosure, and that JSONFormatter’s own privacy policy now carries an explicit warning: “DO NOT SAVE SENSITIVE DATA USING THE SAVE FUNCTIONALITY.”³

Why this is a structural problem, not just a bug

The root cause wasn’t a single vulnerability that got patched — it’s the architecture. Any tool where “paste your JSON” means “upload your JSON to our server” has to get retention, access control, and URL unpredictability right, forever, with no room for a mistake. Get any one of those wrong once, and years of accumulated pastes are exposed at once — which is exactly what happened here.

What running entirely in the browser changes

TryDevSnip’s JSON Formatter and JSON Diff don’t have a save-to-server feature to misconfigure, because there’s no server-side storage step in the first place. What you paste is parsed and rendered in your own browser tab with your device’s own JavaScript engine — it is not uploaded to our servers for processing, so there’s no retention window for tool pastes, no save-to-server URL scheme, and no paste database that could later be crawled. (Page loads, optional analytics, or ratings are separate from your paste content.)

That’s not a policy promise that could quietly change later. It’s the only way the tool works — check it yourself: open DevTools → Network before pasting, and watch for outgoing requests. There won’t be any.

This doesn’t mean every online JSON tool is unsafe. It means the specific failure mode above — a save feature with predictable URLs — is categorically impossible for a tool that never uploads what you paste, because there’s nothing on a server to later crawl.

FAQ

Should I stop using JSONFormatter and CodeBeautify entirely?

Both disabled the save/share feature after disclosure, which closes the specific hole described above. This post isn’t telling you to never use them — it’s explaining exactly what went wrong so you can judge for yourself, and pointing out that a tool with no server-side storage can’t fail this particular way.

Is it safe to paste real API responses or tokens into TryDevSnip’s JSON Formatter?

Yes, for tool processing: your paste is not transmitted to our servers to format or diff. As with any webpage, avoid pasting production secrets if your threat model includes a compromised browser extension — that risk exists locally regardless of which tool you use. Optional analytics or rating requests (if enabled) do not include your paste body.

How do I verify a tool doesn’t upload my data, without trusting a blog post?

Open your browser’s DevTools (F12) → Network tab, then paste and use the tool. If no outgoing request fires, nothing left your device.

← More from the blog