JSON Formatter, Minifier & Validator

JSON is the default data format for APIs, configuration, and logs, but minified or hand-edited JSON is hard to read and easy to break. This tool validates that a string is well-formed JSON and pretty-prints it with the indentation you choose. Validation and parsing happen entirely in your browser, so you can safely format sensitive payloads — tokens, request bodies, configs — without sending them anywhere.

How you'll use it. Paste JSON and get it formatted; if it is invalid, the parser reports the error so you can find the offending comma, quote, or bracket. Set the indent width to match your project's style (2 spaces is the common default). The tool also emits a minified form — the same data with every non-essential byte stripped — plus a size readout, which is what you want when trimming a config for transport or measuring a payload against a length budget. This is the everyday tool for reading an API response, diffing two payloads by formatting both, or tidying a config before committing it.

Common mistakes JSON punishes. Trailing commas ([1, 2, 3,]) are invalid in strict JSON even though many languages allow them. Keys and strings must use double quotes, never single. Comments are not part of JSON — a .json file with // notes will fail to parse. And JSON has no NaN, Infinity, or trailing hex; numbers are decimal. If formatting fails, these are the usual suspects.

A security note on JSON. Parsing JSON with a real JSON parser (as this tool does) is safe; the danger historically was using eval() to parse it, which executes whatever the string contains. Never do that. On the server side, be aware of deserialization risks in formats and libraries that reconstruct arbitrary objects — that is a different, more dangerous operation than JSON parsing. Also watch for oversized or deeply nested JSON as a denial-of-service vector; bound the size and depth you accept.

Defensive angle. Validate untrusted JSON against a schema (types, required fields, allowed values) before you act on it — well-formed is not the same as valid or safe. Reject unexpectedly large bodies, and never reflect raw JSON values into HTML or SQL without the appropriate output encoding — HTML entity encoding for markup contexts, parameterised queries against SQL injection. When a JSON body carries a JWT or an epoch field, the timestamp converter turns those numbers back into readable dates.