Privacy policy

JSON and other text you paste

The JSON tools run in your browser. When you format, validate, repair, compare, convert, escape, or check JSON against a schema, or decode or create a JWT, the work happens on your own device and the text isn’t sent to JSON Tidy’s server.

The JWT decoder only contacts another site if you ask it to, by loading public keys from a JWKS URL or an issuer’s OpenID configuration. It requests the key URL and never sends your token. The JSON viewer can also load JSON from a URL you enter. Your browser requests it straight from that site, and JSON Tidy’s server isn’t involved.

Some things are saved in your own browser so the site works the way you left it. The formatter keeps what you’ve typed in session storage, so it’s still there if you refresh the page, and it’s cleared when you close the tab. Your indentation choice and light or dark theme are kept in local storage. None of this is sent anywhere.

Share links

When you choose Share, your JSON is compressed and put into the link itself, after the #. Browsers don’t send that part of a link to the server, so the JSON isn’t uploaded or stored by JSON Tidy. It also isn’t encrypted, which means anyone who has the link can read it.

The browser extension

The JSON Tidy extension for Chrome only runs on sites you turn it on for. On those sites it keeps a copy of the JSON responses the page loads, so it can list them in the side panel and search through them. The copies are held in the tab’s memory and are gone when you leave the page or close the tab. If you turn on “Keep across page loads”, they’re held in the browser’s session storage instead, which also stays in memory and is cleared when you close the browser.

The extension doesn’t send anything to JSON Tidy or to anyone else. When you open a response in the viewer or the compare tool, the extension passes it to the jsontidy.com page inside your browser. A share link copied from the extension works the same way as one made on the site, with the JSON inside the link. The DevTools tab reads from the network log DevTools already keeps, and only while DevTools is open. The only thing the extension saves on your computer is whether you’ve already seen its note about share links.

The online clipboard

The online clipboard is the one tool that stores what you send, because that’s how it moves text to another device. Text is kept for 10 minutes, or until you delete it, and anyone with the code can read it during that time. It’s encrypted when stored, but the server holds the key, so this isn’t end-to-end encryption. Don’t use it for passwords or anything sensitive.

To enforce the limits on how many transfers can be made, the server keeps a count for each connection. The count is stored under a keyed hash of your IP address, not the address itself, and it expires after 10 minutes. Transfer text and codes are never written to logs or analytics.

The contact form

If you send a message, the text and any name or email address you add go to JSON Tidy’s server, which forwards them by email using Resend. Your email address is only used to reply to you. Messages stay in my inbox, and you can ask for yours to be deleted at any time.

If you’re sending a bug report with some JSON in it, please remove anything confidential first, like personal details, passwords, API keys or customer data. A small sample that shows the problem is all I need.

Analytics

The site uses Vercel Web Analytics to count page visits, which pages are popular, and roughly where visitors come from. It doesn’t use cookies. Before a visit is recorded, the part of the address after # is removed, so your JSON and tokens are never included. The online clipboard isn’t tracked at all.

Ads and cookies

Ads on JSON Tidy are provided by Google AdSense. Google and its partners use cookies to show ads, including ads based on your earlier visits to this site and other sites. Google uses them to choose which ads to show and to count views and clicks.

You can turn off personalized ads from Google in your Google ad settings, and you can opt out of personalized ads from many other companies at aboutads.info. Google explains how it uses information from sites that show its ads in How Google uses information from sites or apps that use our services.

Apart from Google’s ad cookies, JSON Tidy doesn’t set cookies of its own.

Hosting

JSON Tidy is hosted on Vercel. Like any web host, Vercel receives your IP address and browser details when your browser asks for a page, and may keep them briefly in its request logs. You can read Vercel’s privacy policy for the details.

Changes to this policy

If the site starts collecting something new, this page will be updated before it does, and the date at the top will change.

For more about how the tools work and their limits, see About JSON Tidy.