Development Tools
Beautify, minify, and validate JSON with error highlighting and indent control for inspecting API responses, JWT payloads, and security tool output.
JSON is the dominant data format for modern web APIs, and the ability to quickly format, validate, and inspect JSON is a core skill for security testers. Whether you are reviewing an API response in Burp Suite or OWASP ZAP, decoding a JWT payload, or parsing the output of a security scanner, prettified JSON lets you spot exposed fields, verbose error messages, and unexpected data structures that raw minified output hides.
During API testing, readable JSON helps you identify information disclosure such as internal identifiers, tokens, and user data returned in responses, as well as misconfigured endpoints that leak more than they should. This formatter parses and validates JSON locally in your browser, so you can safely inspect sensitive payloads without sending them to a third-party service.
Validation is just as important as formatting. Malformed JSON causes parsing failures in clients and can mask injection attempts where an attacker tries to break out of a JSON structure. Running a payload through this validator confirms whether it is structurally valid before you analyze its contents.
Minified JSON is compact for transport but unreadable for humans, which makes manual review error-prone. Beautifying a response with consistent indentation reveals nested structures, duplicate keys, and hidden fields that might otherwise go unnoticed. When reviewing API output for sensitive data exposure, formatted JSON lets you systematically scan every field rather than guessing at a wall of compressed text.
Error responses are a particularly rich source of information leakage. A verbose error payload in JSON can disclose stack traces, internal paths, database errors, or configuration details that help an attacker map an application. Formatting these responses makes the leakage immediately visible so you can recommend that production returns only generic error messages.
For bug bounty hunters and penetration testers, the ability to rapidly flip between beautified and minified JSON supports both analysis and payload crafting: beautify to read a response, then minify a crafted payload to keep request size down during testing.
When building or assessing JSON-handling code, several principles reduce risk. Always set the correct Content-Type header (application/json) so browsers do not misinterpret the response, validate input against an expected schema rather than trusting structure, and never use eval or Function constructors to parse JSON, which can execute injected code. Use a dedicated parser that throws on invalid input instead.
Watch for JSON hijacking and cross-site data leaks: sensitive JSON returned by a GET request can sometimes be read cross-origin via crafted array overrides on older browsers, so prefer POST for sensitive data and include anti-CSRF protections. Also be careful with JSONP endpoints, which wrap JSON in a callback and can bypass same-origin restrictions.
Finally, minimize what you return. The principle of least privilege applies to data: an API should return only the fields the caller needs, because every extra field is potential information disclosure. Formatting the response here makes it easy to audit exactly what an endpoint exposes.