Are Online JSON Converters Safe? How to Check Before You Paste

I run one of these tools, so treat what follows with appropriate suspicion. That is rather the point: you should not have to trust me, or any other converter, on the strength of a sentence in a footer. You should be able to check. This article is about how.

The distinction that matters

Every browser-based converter falls into one of two categories.

Client-side. The conversion runs in JavaScript inside your browser tab. Your data is read into memory on your own machine, transformed, and offered back as a download. It never travels over the network. The operator could not read it if they wanted to, because it never reached them.

Server-side. Your file is uploaded, processed on a machine somewhere, and the result sent back. Now the operator has had a complete copy of your data. What happens next depends entirely on their policies, their logging, their backups, their security posture, and their honesty. Server access logs, error trackers and CDN caches routinely retain request bodies for days regardless of what the privacy policy says about "storage".

Both designs are legitimate. Server-side is sometimes necessary — for formats that need heavy dependencies, or for files too large for browser memory. But you should know which one you are using before you paste, and the answer is almost never on the page.

Check 1: Watch the network

This is definitive, and it takes under a minute.

1. Open the converter page.
2. Press F12 (or Cmd+Option+I on macOS) to open developer tools.
3. Go to the Network tab and clear the log.
4. Paste some harmless test JSON and run the conversion.
5. Look at what appeared in the list.

If the conversion is client-side, you will see nothing new, or only analytics and ad requests. If your data was uploaded, a POST or PUT request will be sitting there. Click it, open the Payload or Request tab, and you will see your JSON in the body.

Use recognisable test data so you can spot it instantly:

[{"canary": "PLEASE-DO-NOT-UPLOAD-ME-12345"}]

Then use the Network panel's filter box to search for canary. A hit means your data left the machine. This works even if the request is compressed or buried among dozens of others.

Check 2: Pull the plug

The blunt version of the same test. Load the converter page, then disconnect from the network — turn off Wi-Fi, or use the throttling dropdown in DevTools and select Offline. Now try to convert something.

If it still works, the processing is happening locally, because there is nowhere else for it to happen. If it fails or hangs, your data was going somewhere.

This test has one wrinkle: a page that loads code lazily may fail offline for innocent reasons. If it breaks, reconnect and fall back to Check 1, which distinguishes "fetched a script" from "uploaded your data".

Check 3: Read the privacy policy for the right things

Most policies are boilerplate. A few phrases are worth locating specifically, and their absence is as informative as their presence.

Ours is at privacy policy, and it says the conversion happens in your browser. So does everyone else's marketing copy. Check 1 is what separates the two.

What you should never paste anywhere

Even into a tool you have verified. Client-side processing protects the data in transit and at rest on someone else's server; it does not protect you from a shoulder surfer, a compromised browser extension with page access, a shared screen, or a future version of the page that behaves differently.

• Credentials of any kind — API keys, tokens, passwords, connection strings. These frequently ride along inside JSON config files.
• Personal data you are the custodian of — customer names, email addresses, phone numbers, addresses. Under GDPR and similar regimes, pasting this into a third-party tool is a processing activity you are answerable for, whether or not it was ever transmitted.
• Health, financial or biometric records. Regulated categories with specific handling requirements that no free web tool is going to satisfy on your behalf.
• Anything under an NDA or classified by your employer. The relevant question is not whether the tool is safe, but whether you are permitted to use it. Those are different questions with different answers.

Redact first, convert second

Most of the time you do not need the real values. You are checking a structure, debugging a shape, or building a template. Strip the content and keep the schema:

import json

def redact(node):
    if isinstance(node, dict):
        return {k: redact(v) for k, v in node.items()}
    if isinstance(node, list):
        return [redact(v) for v in node[:3]]   # keep the shape, drop the volume
    if isinstance(node, str):
        return "x" * min(len(node), 8)
    if isinstance(node, bool) or node is None:
        return node
    return 0

with open("real.json", encoding="utf-8") as f:
    data = json.load(f)

with open("safe.json", "w", encoding="utf-8") as f:
    json.dump(redact(data), f, indent=2)

Keys, nesting and types survive; values do not. That is enough to test any converter, share a reproduction case in a bug report, or ask a colleague what is wrong with your structure.

When to stay offline entirely

For regulated or contractually restricted data, the correct answer is not a better website. Use something that never involves a browser at all:

Power Query deserves particular mention for corporate use: it is part of Excel, so it needs no approval, no install, and no exception request. For a lot of people that makes it the only viable option regardless of what any web tool promises.

A short checklist

1. Would a leak of this specific data matter? If no, stop worrying and convert it.
2. If yes, run the canary test with DevTools open.
3. If the tool is client-side and the data is genuinely sensitive, redact anyway, or work offline.
4. If the tool is server-side and the data is sensitive, work offline. No policy text changes this.
5. Whatever you choose, do it in a browser profile without extensions.

The general principle is worth more than any specific recommendation: prefer tools whose claims you can verify over tools that ask you to trust them. That applies to this one too.