YAML Validator, Formatter & Converter
Validate YAML and get the exact line of any error, format it into clean 2-space indentation, or convert YAML → JSON and JSON → YAML. Built for the config that runs your infrastructure — Kubernetes manifests, CI/CD pipelines, Docker Compose. Everything runs in your browser; nothing is uploaded.
Everything is parsed locally in your browser — nothing is uploaded, and no custom tags or external references are resolved. This tool covers standard YAML (maps, lists, scalars, comments, flow collections [ ]/{ } and block scalars |/>); anchors &, aliases *, explicit tags !! and multi-document streams are reported rather than silently mis-parsed.
What this tool is
- A free, in-browser YAML toolkit: validate YAML, pretty-format it, convert YAML to JSON, and convert JSON back to YAML — pick a mode and run.
- The validator reports the exact line number of a syntax error — unexpected indentation, a tab used for indentation, a duplicate key, an unterminated quote or an unclosed flow collection.
- Formatting re-emits clean, canonical YAML with consistent 2-space indentation and sensible quoting, so ambiguous values stay the type you meant.
- Covers standard YAML — maps, sequences (block and inline flow), scalars, comments, and block scalars (| and >). Anchors, aliases, explicit tags and multi-document streams are flagged, not silently mis-parsed.
- Everything runs client-side in your browser. Nothing you paste is uploaded, and no custom tags or external references are ever resolved — safe for pasting a config from an untrusted source to inspect it offline.
YAML vs JSON, briefly
YAML and JSON describe the same kinds of data — maps, lists, strings, numbers, booleans and null — but YAML is tuned for humans. It uses indentation instead of braces, allows comments (# to end of line), and offers several ways to write a string. That readability is why configuration lives in YAML: Kubernetes, GitHub Actions, GitLab CI, Docker Compose, Ansible and most Infrastructure-as-Code tools. JSON, with no comments and no significant whitespace, is the safer wire format for machine-to-machine APIs. Every JSON document is also valid YAML, so JSON → YAML always succeeds; going the other way drops comments and anchors, which JSON cannot express.
The pitfalls this catches
- Tabs for indentation. YAML forbids them. A file that looks perfectly aligned fails to parse because one indent is a tab, not spaces — this tool names the line.
- The Norway problem. Unquoted
no/yes/on/offbecome booleans in YAML 1.1 — soNO(Norway) silently turns intofalse. Here onlytrue/falseare booleans; those words stay strings. - Duplicate keys. Two keys with the same name in one mapping is almost always a copy-paste bug; a loader keeps only one of them. This tool rejects it and points at the second occurrence.
- Leading-zero numbers. A ZIP code like
007or a version like1.10can be mangled into a number. Leading-zero values are kept as strings here, and the formatter quotes anything ambiguous. - Unterminated quotes and unclosed flow collections. A missing
"or]is reported with its line instead of producing a confusing cascade of errors.
Why YAML is a security surface
So much security-critical infrastructure is defined in YAML — Kubernetes RBAC and admission policies, CI/CD pipelines that hold deploy secrets, Terraform and other IaC — that a one-space indentation slip or a value that quietly changed type can become a real misconfiguration: a role bound too widely, a pipeline step that no longer runs, a network policy that does not match. Validating before you ship is a cheap guard against an expensive mistake.
Security note: YAML has a genuine remote-code-execution history. Older parsers — Python's yaml.load and Ruby's YAML.load — would instantiate arbitrary objects from custom tags such as !!python/object, so loading an untrusted config could run code. Always use a safe loader (yaml.safe_load, Psych.safe_load) in your own code. This tool is a safe parser by construction: it reads only standard data, refuses custom tags, anchors and external references, and parses everything locally — nothing you paste leaves your browser.
Frequently asked questions
What is YAML, and how is it different from JSON?
YAML (YAML Ain’t Markup Language) is a human-friendly data serialization format used heavily for configuration — Kubernetes manifests, CI/CD pipelines (GitHub Actions, GitLab CI), Docker Compose, Ansible playbooks and application config. It uses indentation to show structure instead of JSON’s braces and brackets, supports comments (lines starting with #), and is generally easier for people to read and edit. JSON is a strict subset of YAML in spirit: every JSON document is valid YAML, but YAML adds comments, multiple scalar styles, block scalars and anchors. JSON is better for machine-to-machine APIs because it is unambiguous and has no significant whitespace; YAML is better for hand-edited config. This tool converts between the two so you can move config into an API payload, or make a dense JSON blob readable.
Why does my YAML fail to parse even though it looks fine?
The usual culprits are whitespace and typing surprises. (1) Tabs: YAML forbids tab characters for indentation — an editor that inserts a tab produces a file that looks aligned but will not parse. Use spaces. (2) Inconsistent indentation: every item at the same level must share the same indent, and nested content must be indented further than its parent. (3) A missing space after the colon: it must be "key: value", not "key:value". (4) Unquoted special characters: a value that contains a colon-space, starts with a quote, or begins with a character like @, `, * or & needs to be quoted. (5) Duplicate keys in the same mapping. This tool pinpoints the line so you are not hunting through hundreds of lines of a manifest.
What is the "Norway problem" and does this tool avoid it?
The Norway problem is the classic YAML footgun where the unquoted value no is interpreted as the boolean false (and yes/on/off likewise become booleans) under YAML 1.1. So a list of country codes written as [NO, SE, FR] can silently turn NO (Norway) into false. The same bites version numbers (1.10 becoming the float 1.1), ZIP codes and phone numbers with leading zeros, and times like 22:22. This tool follows the modern core-schema behavior: only true and false are booleans, and yes/no/on/off stay strings — so NO survives as the string "NO". When you need a numeric-looking or boolean-looking value to stay a string, quote it ("NO", "007", "1.10"); the formatter also quotes such values automatically when it re-emits YAML.
Is it safe to paste a config file here? Is YAML a security risk?
Yes — everything is parsed in your browser and nothing is uploaded, so you can safely inspect a YAML file from an untrusted source. YAML itself has a real security history: some language parsers (notably older PyYAML yaml.load, and Ruby’s YAML.load) would instantiate arbitrary objects from custom tags like !!python/object or !ruby/object, turning a loaded config file into remote code execution. The guidance everywhere is to use the safe loader (yaml.safe_load, Psych.safe_load) that only produces plain data. This tool is deliberately a safe parser: it understands only standard data constructs and explicitly refuses anchors, aliases, custom tags and external references — it will never instantiate anything. Because so much security-critical infrastructure (Kubernetes RBAC, admission policies, CI secrets, IaC) lives in YAML, a tiny indentation or type mistake can become a real misconfiguration, which is exactly why validating before you ship matters.
Does converting YAML to JSON lose anything?
It can, because YAML expresses a few things JSON cannot. Comments are dropped — JSON has no comment syntax, so any # notes disappear on conversion. Anchors and aliases (YAML’s way of reusing a block) are not part of JSON and are not supported here. Special float values like .inf and .nan have no JSON representation. Ordinary data — maps, lists, strings, numbers, booleans and nulls — converts losslessly in both directions, and converting JSON to YAML always succeeds because JSON is within YAML’s data model. If you round-trip YAML → JSON → YAML, expect to lose comments and formatting but keep the data.