security
CodeBeautify and JSONFormatter Leaked 80,000 Pastes. How to Format JSON Without Uploading It
Researchers pulled cloud, database, and bank-client credentials from saved pastes on two JSON formatters. The leak was the Save feature, not the formatting.
Pasting a config file into an online formatter feels like using a calculator. You paste, you click, you copy, you close the tab. In November 2025, researchers at watchTowr showed that on two of the best-known sites, a lot of those pastes never went away. The formatting was not the leak. The Save button and a public list of saved links were. That distinction matters, because it means “runs in your browser” is not the whole answer to “is this tool safe?”
This post sticks to what the researchers published, then gives you a 30-second check you can run on any tool, including ours.
What watchTowr found
On 25 November 2025, watchTowr Labs published Stop Putting Your Passwords Into Random Websites, by Jake Knott. BleepingComputer covered it the same day. The numbers, as the report states them:
| Item | Figure from the report |
|---|---|
| Saved submissions downloaded | 80,000+ |
| Data collected | 5 GB+ of JSON (enriched and annotated by watchTowr) |
| History covered, JSONFormatter | 5 years |
| History covered, CodeBeautify | 1 year |
| Estimated saved uploads on jsonformatter.org | About 350,000 (35,000 pages of history, 10 links per page) |
The 80,000 is what watchTowr downloaded, not the total. Their own estimate for jsonformatter.org alone is several times larger.
The kinds of data they list include Active Directory credentials, database credentials, cloud environment keys, private keys, code repository keys, CI/CD pipeline credentials, card payment gateway credentials, FTP and RTSP credentials, administrative JWTs, SSH session recordings, an AWS Secrets Manager export, and personal data including KYC (identity verification) records. The affected sectors in the report span government, critical national infrastructure, banking, finance, insurance, aerospace, healthcare, education, telecoms, retail, travel, technology, and cybersecurity. BleepingComputer’s examples include production AWS credentials from a major financial exchange and Active Directory credentials from a managed security provider, along with credentials for one of its US bank clients.
watchTowr says it spent months contacting affected organizations over multiple channels. A handful responded quickly. Most did not. Several national CERTs, including CISA, NCSC UK, and CERT-EU, asked for the data relevant to them.
The part that was not formatting
Both sites let you save what you pasted. Saving creates a link of the form jsonformatter.org/{id} or codebeautify.org/{tool}/{id}. That link was also listed on a “Recent Links” page, with a title, description, and date, open to anyone. BleepingComputer describes the Recent Links pages as following a structured, predictable URL format, so a simple crawler could walk the listing. watchTowr then pulled the raw content for each ID through the sites’ own getDataFromID endpoint.
So the exposure needed three things at once:
- A server-side copy of your paste (created by Save).
- An identifier for that copy.
- A public place where those identifiers were listed.
Remove any one and the bulk harvest stops working. Note that “the formatter runs in JavaScript in your browser” removes none of them. A tool can format locally and still upload your text the moment you click Share.
Neither article reports a response from the two sites. BleepingComputer noted that Recent Links was still reachable on both when it published. We have not checked their current state, so don’t assume it either way.
Someone was already watching
watchTowr also ran a test. They created fake AWS keys with Canarytokens (decoy credentials that alert their owner when used), pasted them into the formatters, saved them, and set the links to expire after 24 hours. The first attempt to use the fake keys came 48 hours after the upload, which is a full day after the content had been removed.
That is the detail to remember. Someone else was already scraping these listings and testing what they found, and copies outlived the original link. Deleting a paste does not recall it from whoever already fetched it.
The 30-second check for any online tool
You can’t audit a site’s servers. You can check what your own browser sends. This works for any formatter, decoder, or converter.
- Look for Save, Share, Permalink, or Recent. Any of these means the tool can put your input on a server. That is not automatically bad, but it’s the exact feature that leaked here. If you don’t need it, don’t click it.
- Open the Network tab, then click the button. In Chrome or Firefox press F12, choose Network, clear the list, paste your input, and click Format. Then look at each new request. A local tool makes no request that carries your text. Click a request and check its Payload or Request tab if you are unsure.
- Try airplane mode. Load the page, go offline, then paste and format. If it still works, the formatting is local. If it fails, it needed the network for something. (Some tools load their parser code the first time you type. In that case type one character before going offline.)
- Read the privacy note, but trust step 2 more. A sentence saying “your data never leaves your browser” is a claim. The Network tab is evidence.
One caution about step 2. You will often see analytics requests (Google Analytics and similar). Those are normal on free sites. What you are looking for is your pasted content, or something that looks like it, inside a request body or URL.
What Lunchbox Hands does and does not send
We read the source of every tool linked below before writing this. Here is what it shows.
| Tool | Where your input goes |
|---|---|
| JSON Formatter | Nowhere. JSON.parse and JSON.stringify in your tab. No save, no share, no history. |
| YAML Validator | Nowhere. The YAML parser code is downloaded from our site the first time you type, then runs locally. |
| SQL Formatter | Nowhere. Same pattern: the formatter library loads on first input, then runs locally. |
| JWT Decoder | Nowhere. It Base64url-decodes the header and payload locally. It does not verify signatures. |
| PII Scrubber | Nowhere. Pattern matching runs locally. |
None of these five tools makes a network request containing what you paste, and none of them writes your input to browser storage.
What the site does send, so you are not surprised in the Network tab:
- Google Analytics. Page views, and a few click events such as “copy” or “download”, tagged with the page path. These events do not include the text you pasted or the output.
- Your theme choice and a tip-button variant are kept in your own browser’s
localStorage. Some tools that build documents or plans (such as the invoice generator, resume builder and wedding seating chart) also keep your draft there, and the IndexNow submitter remembers your key, so a refresh doesn’t wipe them. That storage stays on your device. - One tool has a server-side share link: the SEO analyzer. When you click “Create share link”, it stores the report about the public web page you analyzed. The link uses a random 10-character ID, expires after 90 days, and there is no public list of shared reports. Anyone with the link can open it, so treat it like any unlisted link. The report itself is stored only if you click that button. Running an analysis does log the URL you analyzed, with your country and device type, to our usage database.
- Tools that need the network send your input to our API. DNS lookups, WHOIS, the webhook tester and similar tools can’t work otherwise, and we log the domain or URL you checked. The keyword density tool also logs the five most frequent words from your text. None of the five tools above does either.
We don’t offer Save or Share on the JSON, YAML, SQL, JWT, or PII tools. After reading the watchTowr report, that looks like the right default.
Habits that help regardless of the tool
Scrub before you paste. If you’re sharing a log or payload with a colleague or a model, strip what you can first. Our PII Scrubber catches emails, phone numbers, US SSNs, card numbers, IP addresses, and IBANs. It does not detect API keys, passwords, or private keys, which were most of what leaked here, so remove those by hand. Why pattern matching always misses something is covered in why regex PII redaction leaks.
Rotate anything that ever touched a third-party site. If a real secret went into a paste you saved anywhere, assume it’s exposed and rotate it. The canary test shows the keys were being tried within two days.
Treat debug exports as credentials. The same mistake shows up with browser HAR files sent to support teams. Your HAR file has your login session in it walks through that case.
Decode tokens, don’t upload them. A JWT’s payload is only Base64url, so you never need a server to read it. Paste it into the JWT Decoder and check the claims locally.
Next time you need to tidy a JSON blob with something sensitive in it, open the JSON Formatter with the Network tab open beside it. Paste, click Format, and watch the request list stay quiet.