Paste a payload, get it readable. Everything runs in your browser, so production responses, tokens and config files stay on your machine.
Nothing you paste leaves your browser. The connect-src allowlist makes that a browser guarantee rather than a promise. Check it yourself
In November 2025, two of the biggest formatter sites leaked more than 80,000 saved pastes: Active Directory credentials, cloud keys, access tokens and banking records, from government, healthcare and aerospace organisations. Their homepage said your data was handled in the browser. Their file upload posted it to a server.
The header on the right is the one this site sends on every response. Its connect-src line is an allowlist naming one destination, the analytics endpoint that counts page views. Every other request this page could attempt is refused: no fetch, no XHR, no WebSocket, no beacon carrying your payload anywhere. It is not a claim about our intentions. It is a rule the browser enforces on any code that runs here, including code we might add by mistake later.
Content-Security-Policy:
default-src 'self';
connect-src https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com;
script-src 'self' https://www.googletagmanager.com;
style-src 'self' 'unsafe-inline';
img-src 'self' data: https://*.google-analytics.com https://*.googletagmanager.com;
font-src 'self';
form-action 'none';
frame-ancestors 'none';
base-uri 'self';
object-src 'none';
worker-src 'self' blob:
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
Permissions-Policy: interest-cohort=(), browsing-topics=()Every example below is real output from this parser, and every one of them is something a formatter that wraps JSON.parse gets wrong.
Formatting re-emits the exact digits you pasted. A tool that parses to a float and stringifies back has already changed your Snowflake ID before you pressed the button.
Here
{ "id": 12345678901234567890 }JSON.parse round trip
{ "id": 12345678901234567000 }Paste from a doc or a chat client and you get characters you cannot see. Other tools say Unexpected token.
4:8 Invalid whitespace:
no-break space (U+00A0).When a file is truncated, the useful information is where each open bracket started, not that the document ended.
The document ends while 3 brackets
are still open: { opened at line 1,
column 1; [ opened at line 2, column 8;
{ opened at line 3, column 5.Lenient mode fixes near-JSON and lists every change, separating the safe ones from the judgement calls.
2:3 Converted a single-quoted string
to a double-quoted JSON string.
5:11 Quoted 02134 as the string
"02134", because dropping the
leading zero would change a
zip code.RFC 8259 leaves duplicates undefined and most parsers silently keep the last one.
3:3 Duplicate key "email",
first defined at line 2,
column 3.Parsing and formatting run in a Web Worker, so the interface stays responsive while a large document is processed. The figures below are time to format, measured across two runs on one desktop machine, so treat them as a range rather than a benchmark. At 10 MB that is enough work to lock a main thread solid, which is why it does not happen on one.
9 to 13 ms
100 KB
70 to 119 ms
1 MB
0.6 to 0.8 s
10 MB
{
"user": "priya",
"roles": ["admin",],
}3:20 Trailing comma before ].
Remove the comma before the closing bracket. Trailing commas are legal in JavaScript and JSON5 but not in JSON.
V8 rewrote almost all of its JSON error messages in 2022, and most of what is written about them online still teaches the old wording. These pages carry the exact current strings, measured by running the parsers, with the real causes ranked by how often they actually happen.
Unexpected end of JSON input "[object Object]" is not valid JSON Bad control character in string literal in JSON at position N (line L column C) Expected double-quoted property name in JSON at position N (line L column C) Expecting value: line 1 column 1 (char 0) Unexpected token '<', "<!DOCTYPE "... is not valid JSON A JSON beautifier reads a document, parses it into a tree of objects, arrays, strings, numbers, booleans and nulls, and writes that tree back out with one value per line and a consistent indent. The important word is parses. It is not inserting newlines after every comma with a regular expression, which is how a surprising number of snippets on the web do it, and which quietly destroys any string that happens to contain a comma or a brace.
That has a consequence people meet immediately: a document that is not valid JSON cannot be beautified. There is no tree to print. This is why beautifying and validating are the same operation here rather than two buttons, and why an invalid paste gets a line and column and a description of what was expected instead of a blank output panel.
Whitespace outside of strings carries no meaning in JSON. RFC 8259 permits space, tab, carriage return and line feed between any two tokens, so reformatting cannot change what a document means. Whitespace inside a string is data and is left exactly as it was. A pretty printer that works on text rather than on a parse tree cannot tell those two cases apart, and that is the single most common way formatting corrupts a payload.
Key order is preserved. The specification calls objects unordered, so nothing is allowed to depend on it, but the order you pasted is almost always the order a diff, a code review or a human reader expects, and reordering keys makes every subsequent comparison noisy for no gain.
Paste into the left panel and press Beautify. The formatted document appears on the right, ready to copy or download. There is no account, no upload step, no daily quota and no paywall on any of it, which is what most people mean when they search for a JSON beautifier online free rather than a trial of a desktop product.
The default indent is two spaces, which is what most language ecosystems and most style guides settle on. Four spaces and tabs are both available if your repository has already made that decision for you, and the choice is remembered locally in your browser rather than on a server, because there is no server to remember it on.
Everything runs in a Web Worker, so the interface stays responsive while a document is parsed. A 100 KB payload formats in roughly 9 to 13 ms, 1 MB in 70 to 119 ms, and 10 MB in about 0.6 to 0.8 seconds, measured on one desktop machine across two runs. Treat those as a range rather than a benchmark, but the shape is the point: a 10 MB file is enough work to freeze a main thread solid, and it does not run on one.
After the first visit the page is cached, so this online JSON beautifier keeps working with the network disconnected. That is not a service worker trick. It is the natural result of a static page that does its work locally: with the network gone the analytics ping simply fails, and every tool carries on, because none of them needed a server in the first place.
Most formatters are a text area and a button. Paste goes in, formatted text comes out, and if the document was broken you are back in your own editor guessing. The panel here is a JSON beautifier and editor in one, a real code editor with syntax highlighting, bracket matching, code folding, incremental search and inline error markers, so you can fix the thing you pasted and reformat it without leaving the page.
Folding matters more than it sounds. A 4,000 line configuration file is not readable just because it is indented. Collapsing every branch except the one you care about is what actually makes it readable, and that is a property of the editor, not of the formatter.
If you want the same document as a collapsible tree rather than as text, the JSON viewer renders it that way. Validation reports every problem rather than stopping at the first. Repair handles near-JSON such as single quotes, trailing commas and unquoted keys, and lists every change it made so you can reject the ones that were judgement calls rather than fixes.
People searching for the best JSON viewer and JSON beautifier online are usually not asking about indentation, which every tool gets right. They are asking about the documents that break tools: integers larger than JavaScript can hold, duplicate keys, and invisible characters pasted out of a chat client or a word processor. Those are handled here, they are described in the cards above with real output, and they are the only part of this worth arguing about.
A browser tab is not always where you want this to happen. If the file is already open in your editor, the fastest JSON beautifier is the one bound to a keystroke there.
Notepad++ has no JSON formatter built in. The usual Notepad++ JSON beautifier is the JSTool plugin: open Plugins, then Plugins Admin, search for JSTool, install it, restart, and the command appears under Plugins, JSTool, JSFormat. It works, and for everyday payloads it is the right tool. Be aware that JSTool parses numbers into 64-bit floats, so a Twitter or Snowflake style ID above 9007199254740991 comes back with different digits than it went in with, silently.
The Sublime Text JSON beautifier is the Pretty JSON package, installed through Package Control and bound to Ctrl+Alt+J by default. It formats through Python, which means large integers survive exactly, a genuine advantage over the JavaScript based options. It does drop duplicate keys without saying anything, keeping the last one.
VS Code needs no plugin at all. Format Document, which is Shift+Alt+F on Windows and Linux and Shift+Option+F on macOS, formats any file the editor recognises as JSON. There is also a dedicated Format JSON command in the palette.
What none of those give you is a diagnosis. They format a valid document and refuse an invalid one, which is fine until the document is invalid and 40,000 lines long. That is the case this page is built for, and it is also the case for a machine you are not allowed to install plugins on.
A JSON beautifier Chrome extension does something genuinely useful: it intercepts responses served as application/json and renders them formatted and collapsible in the address bar, so an API you are poking at is readable without a round trip through a formatter. Firefox has done this natively since version 44 and needs no extension for it at all.
The cost is worth reading before you install one. To rewrite the page for any API you visit, the extension has to request permission to read and change your data on all websites, which is the broadest permission Chrome grants. That permission covers your bank, your email and your company admin console, and it persists through every silent update the extension ships afterwards. A JSON beautifier extension is a reasonable thing to install from a maintainer you have reason to trust, and a bad thing to install because it was the top result.
This page needs none of it. It works the same in Chrome, Firefox, Safari and Edge, it installs nothing, and it holds no permissions over any other site you visit, because a page is not an extension: it can read itself and nothing else. Paste is one keystroke more than an interception extension and it is the only difference.
You do not need a library for this. JSON.stringify takes a third argument that controls indentation, and it is built into every JavaScript runtime: JSON.stringify(value, null, 2) indents with two spaces, and passing a string instead of a number, as in JSON.stringify(value, null, "\t"), indents with tabs.
Rendering the result into a page is where an HTML JSON beautifier goes wrong. The output has to sit inside a <pre> element or every run of spaces collapses and you have undone the formatting, and it has to be escaped before it is inserted as HTML. A string value containing </script> or an angle bracket is otherwise being handed to the parser as markup, which is a cross site scripting hole with extra steps.
In React that escaping is already done for you. <pre>{JSON.stringify(data, null, 2)}</pre> is the whole of a React JSON beautifier for debugging purposes, and because React escapes interpolated text by default it is safe with untrusted input. The rule is simply never to reach for dangerouslySetInnerHTML to render JSON, which is the one way to lose that guarantee.
The caveat that applies to all of these is numeric precision. JSON.parse turns every number into a double, so an identifier above 2^53-1 is already the wrong number before JSON.stringify ever sees it, and no amount of formatting brings the digits back. If your payload carries large IDs, read what happens to an integer above 2^53-1 first. The beautifier on this page re-emits the exact digits you pasted, which is why its output and a JSON.parse round trip do not always agree.