A large share of websites that process text now say something like “your data never leaves your browser”. Some of them mean it. The 2025 formatter incident, where two of the largest sites in this category exposed gigabytes of submissions that included live cloud credentials, happened at sites that would probably have said the same thing.
So the claim is worth testing rather than believing. Here is the procedure, which works on any tool, including this one.
1. Watch the network panel while you work
Open developer tools with F12 (or Cmd+Option+I), switch to the Network tab, and clear it. Then paste something into the tool and let it run.
What you are looking for is any request whose payload contains your input. Sort by size and check the largest requests first — a server-side formatter has to send the document somewhere, and those requests are usually easy to spot: a POST with a JSON or form body, often to an endpoint named /api/format.
Two things you will almost always see and should not worry about:
- The page HTML, CSS and JavaScript being loaded. That happens before you type and cannot contain your input.
- Advertising and analytics requests. These are a legitimate concern for privacy in general, but they are a different question from whether the tool itself transmits your text.
The specific thing you are checking is whether a request appears after your keystroke, and whether its body grows in proportion to what you pasted.
2. Turn off the network and keep working
The stronger test. Disconnect from Wi-Fi, or use your browser’s offline toggle in the Network panel, then use the tool again.
A locally-computed tool works exactly the same. A server-side tool fails, hangs, or produces an error — and the failure mode is the giveaway. If a “formatter” cannot format without a network connection, the formatting is not happening in your browser.
This test is also the fastest way to check a whole site at once, because it does not require reading any code.
3. Read the source, but only where it matters
You do not need to audit an entire codebase. Two searches cover most of it.
Search for fetch( and XMLHttpRequest in the JavaScript the page loaded. In Chrome’s Sources panel you can search across all loaded files with Ctrl+Shift+F (Cmd+Shift+F). A tool that computes locally will have no reason to call either one in its input path.
Search for localStorage and sessionStorage. This is how a tool would keep a copy of your input after you close the tab. A tool that stores your text there is not uploading it, but it is retaining it, which is a different kind of exposure — a shared computer, a browser extension with storage access, or a later XSS bug all become a problem.
Note the distinction between a request and a stored value: both matter, and “no upload” alone does not tell you a tool is safe to paste credentials into.
4. Check what the adverts can see
A page can keep the tool local and still hand your data to a third party, for example by putting your input into the DOM of a form that an advertising or analytics script reads, or by pushing it into a data layer.
The practical check is whether your input is ever written into an element that a third-party script can read: a hidden input, a <form>, or a global like window.dataLayer. If a tool writes your JSON into a form field “for submission”, treat it as a server-side tool, because that is where it is going.
Why this category has a problem in the first place
Formatting JSON, decoding Base64, converting a timestamp — none of these need a server. They are pure string transformations with no shared state, no database, and nothing that benefits from a beefy machine elsewhere.
A server enters the picture for one of three reasons: the author wants to log usage, the author wants to store documents as a product feature, or the original implementation was written that way and nobody revisited it. All three produce the same outcome — a copy of your production payload sitting somewhere you cannot see.
For a tool that runs locally, the correct architecture is the boring one: ship the code, run it in the tab, store nothing. That is what this site’s JSON formatter does, and the three checks above take about ninety seconds to confirm it. The same procedure works on any tool you are about to trust with an API response.