Skip to content
jsonbeautifiers
English

Privacy

The short version: what you paste never leaves your machine, and you can verify that yourself rather than taking our word for it. We do count page views. Here is how to check both.

Your JSON

Nothing you paste, type, drop or open on this site is transmitted anywhere. Every tool runs entirely inside your browser. There is no server that processes your data because there is no server involved at all beyond the one that sent you these files.

This is enforced by the browser rather than promised by us. Every page on this site is served with:

Content-Security-Policy:
  default-src 'self';
  connect-src https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com;
  script-src 'self' https://www.googletagmanager.com;
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https://*.google-analytics.com https://*.googletagmanager.com;
  font-src 'self';
  form-action 'none';
  frame-ancestors 'none';
  base-uri 'self';
  object-src 'none';
  worker-src 'self' blob:

The connect-src directive is an allowlist, and it names one destination: the analytics endpoint described below. Every other outbound request the page could make is refused by the browser, whether it is a fetch, an XMLHttpRequest, a WebSocket, an EventSource or a sendBeacon. There is nowhere for the contents of the editor to go. That applies to all code on the page, including any we might add in future and including a compromised dependency.

Files you open are read with the browser's FileReader. There is no upload endpoint on this site. There is also no feature that loads a document from a remote URL, because that would require a server proxy, and a server proxy would defeat the whole arrangement.

What is stored, and where

Two things, both in your browser's localStorage, both on your own device:

  • Your current draft, per tool, so that a refresh does not lose your work. Drafts larger than 512 KB are not stored at all.
  • Your settings: indentation, theme, and the options for each tool.

Clearing site data in your browser removes all of it. None of it is transmitted, and we have no way to read it.

Cookies

Google Analytics sets two, _ga and a _ga_ counterpart. They hold a randomly generated visitor id, which is how one person returning twice is told apart from two people arriving once. Nothing else here sets a cookie: your drafts and settings use localStorage, which stays on your device.

There is no consent banner. If you would rather not be counted, blocking cookies for this domain, or any content blocker, removes the analytics completely, and every tool on this site keeps working exactly as it did before.

Analytics and advertising

This site uses Google Analytics 4 to count page views. It records which page you are on, where you arrived from, your language, your screen size, a coarse location derived from your IP address, and the visitor id from the cookie above.

It does not record anything you paste. The document lives in the editor and in the worker that formats it, and the analytics script can reach neither. This is not a policy we follow; it is what the connect-src allowlist above leaves possible.

There is no advertising, and no third-party script other than the analytics tag.

Third parties

One: the Google Analytics tag, loaded from googletagmanager.com. Everything else is served from this domain. No fonts from a font CDN, no other scripts from a script CDN, no embedded widgets, no social buttons, no error-reporting service.

The site is hosted on Cloudflare Pages. Like any host, Cloudflare processes the network request that delivers a page to you, which necessarily involves your IP address and the URL you requested. That is what serving a web page is. It does not include anything you paste into a tool, because that is never sent.

What this does not protect you from

  • A browser extension with permission to read page content can read this page, as it can read any page. No website can prevent that.
  • Anyone with access to your device can see your screen and your browser storage.
  • Whatever you do with the output after you copy it.

Children

This site is a set of developer tools and it is not directed at children. The only personal data involved anywhere on it is what the analytics above records: a visitor id, an approximate location and which pages were viewed. Nothing anyone pastes is collected, at any age.

Your rights

Regulations such as the GDPR and the CCPA give you rights of access, correction and erasure over personal data held about you. The only personal data connected to this site is what Google Analytics collects: a cookie-based visitor id, an approximate location from your IP address, and which pages were viewed. Clearing cookies for this domain detaches you from that id, and any content blocker stops the collection before it starts.

Nothing you paste is ever collected, so on that side there is nothing to access, correct or erase. If you would like any of this confirmed in writing, get in touch.

Changes to this policy

If this policy ever changes in a way that weakens any statement above, that change will be recorded on the changelog with its date. A privacy policy that can be quietly loosened is not worth reading.

Last reviewed 2026-09-05.