JSON Formatter & Validator
Beautify, minify and validate JSON live. Get a precise line:column error with a caret pointing at the exact problem, choose 2-space / 4-space / tab indentation, optionally sort keys, explore a collapsible tree view, and escape or unescape JSON strings. Everything runs in your browser; your JSON is never uploaded.
Parsed and formatted entirely in your browser — your JSON (configs, tokens, API responses, customer data) never leaves your device. Safe for pasting a sensitive config or a secret-bearing payload to inspect it without sending it to any server.
What this tool is
- A free, in-browser JSON formatter and validator — paste JSON, see it beautified, minified or validated live, with no signup and nothing uploaded.
- Validation gives a precise error: the exact line and column of the first problem, the reason, and a caret pointing at the character (far clearer than JSON.parse’s one-line message).
- Beautify with 2-space, 4-space or tab indentation; minify to the smallest valid form; optionally sort every object’s keys A→Z for stable diffs.
- A collapsible tree viewer, JSON-string escape/unescape, and live stats (node count, nesting depth, key count, byte size) are all built in.
- Everything runs client-side, which is why it is safe for pasting a sensitive config, an API response or a secret-bearing payload — your data stays on your device.
What is JSON, and what makes it valid?
JSON (JavaScript Object Notation) is a lightweight, text-based format for structured data. It is built from just a few pieces: objects ({ "key": value }), arrays ([ value, value ]), strings in double quotes, numbers, the literals true, false and null. It is the default wire format for web APIs, config files and logs, which is why a quick, trustworthy way to format and check it matters.
JSON is stricter than the JavaScript object syntax it resembles, and that is where most "why is this invalid?" surprises come from. The rules that trip people up:
- No trailing commas.
{"a":1,}is valid JavaScript but invalid JSON — the comma after the last member must go. - Double quotes only. Keys and strings must use
"…"; single quotes and unquoted keys are rejected. - No comments. Neither
//nor/* */are allowed in strict JSON. - No
NaN,Infinityorundefined. Only finite numbers and the three literals are valid values. - Escapes inside strings. Literal control characters, lone backslashes and raw newlines inside a string must be escaped (
\n,\",\\).
JSON vs JSON5
JSON5 is a popular superset for hand-written config: it allows comments, trailing commas, single quotes and unquoted keys. It is friendlier to edit, but it is not what JSON.parse accepts — and this validator, like every browser and most APIs, checks against strict JSON. If a file validates in your editor but fails here, it is probably relying on a JSON5 extension; strip the comments and trailing commas to get strict JSON.
A security note on handling JSON
- This tool is client-side, so paste freely. Because nothing is uploaded, you can inspect a configuration file, a JWT payload, a webhook body or a cloud-provider response that contains tokens or customer data without exposing it to a third party — unlike many online formatters that POST your input to their backend.
- Be careful parsing untrusted JSON on the server. Naive mergers and deserializers that copy keys from attacker-controlled JSON into an object can be abused for prototype pollution — a payload containing
__proto__orconstructor.prototypekeys that mutateObject.prototypeand change behaviour app-wide.JSON.parseitself is safe, but how you use the result may not be. - Validate size and shape, not just syntax. Deeply nested or enormous JSON can exhaust memory or stack on the server (a "JSON bomb"). The live stats here (depth and node count) give you a quick read on how large and how deep a document really is before you feed it into a pipeline.
Privacy: this formatter never transmits your JSON. Parsing, validation, the tree view and all stats run in your browser, so configs, tokens and personal data stay on your machine.
Frequently asked questions
What is a JSON formatter?
A JSON formatter (also called a JSON beautifier or pretty-printer) takes JSON that is minified, cramped or inconsistently indented and re-emits it with clean, consistent whitespace — one key per line, nested objects and arrays indented so the structure is obvious at a glance. A good formatter is also a validator: before it can format, it has to parse, so anything it cannot parse is flagged as invalid with the location of the problem. This tool beautifies with your choice of 2-space, 4-space or tab indentation, can minify in the other direction, can sort object keys for stable diffs, and shows a collapsible tree view of the structure.
Is my JSON uploaded to a server?
No. All parsing, formatting, validation and tree rendering happen entirely in your browser using JavaScript — your JSON is never sent to PlayCISO or any other server, and nothing is logged. That is the whole point of a client-side tool: you can safely paste a configuration file, an API response, an access token or any secret-bearing payload to inspect or tidy it without it ever leaving your device. If you disconnect from the network the tool keeps working, which is a quick way to prove to yourself that no upload is happening.
Why is my JSON invalid?
The most common causes are a trailing comma after the last element of an object or array (valid in JavaScript, forbidden in JSON), single quotes instead of double quotes around keys or strings, unquoted object keys, comments (// or /* */, which JSON does not allow), a missing comma between two members, an unescaped control character or backslash inside a string, or a value like NaN, Infinity or undefined that JSON cannot represent. This tool reports the exact line and column of the first error, names the reason, and draws a caret under the offending character so you can jump straight to it.
What is the difference between JSON and JSON5?
Strict JSON (the format this tool validates against) is deliberately minimal: double-quoted keys and strings, no comments, no trailing commas, and a fixed set of value types. JSON5 is a superset aimed at hand-written config files that allows comments, trailing commas, single quotes, unquoted keys, hexadecimal numbers and more. Browsers’ built-in JSON.parse — and therefore this tool — accepts only strict JSON, so if your file relies on JSON5 features it will be reported as invalid. Convert it to strict JSON (remove comments and trailing commas, use double quotes) before using it anywhere that expects standard JSON.