Do you upload my files or JSON?

Not for the free tools — there is no upload at all, even for file conversions like Excel to JSON, which are read and converted in your browser. Data only reaches our servers when you run an AI action or turn on optional cloud features like project sync.

Can I turn off AI history?

Yes. Switch off "Save AI history" in Settings → Privacy & Data, and your inputs and AI results are not stored on our servers — only a content-free record of credits used. When history is on together with masking, the saved results contain placeholders instead of your real values. You can also delete individual entries or your entire stored history at any time from the History panel.

Where are my projects stored?

Wherever you choose. With "Store projects in the cloud" turned off, new projects stay in your browser only — they show a "This device" badge and are never uploaded. Turn cloud sync on only if you want projects available across devices.

What happens to card numbers or passwords in my JSON?

In the free tools, nothing — your JSON never leaves your device, so they are never uploaded anywhere. In AI actions, they are detected and masked on your device, so detected values reach the AI only as placeholders like [MASKED_CARD_1], and the originals are restored locally in your result. Detection is pattern-based, so give your JSON a quick glance before sending anything truly critical.

Security & Privacy

Is it safe to paste JSON here? Yes. Here is exactly what happens to it.

Q: What does the AI actually see?

Your JSON with sensitive values replaced by placeholders like [MASKED_PASSWORD_1]. The masking happens on your device before the request is sent, so detected passwords, keys, and card numbers never leave your browser. Detection is pattern-based, so values under unusual field names may not be caught — review your sample if it holds secrets under nonstandard keys. It is on by default, and the result is un-masked locally when it comes back.

No vague promises. This page walks through every part of JSON Copilot and tells you, in plain words, what stays on your device, what reaches our servers, and which switches put you in control.

Open the Editor

Free tools never upload your JSON · AI masking is on by default · History and cloud sync are optional

In your browser

Free tools do all their work on your device — no upload

Masked first

AI actions mask detected passwords, keys & card numbers on your device

Your choice

AI history and cloud project sync are switches you control

How each part handles your data

JSON Copilot has three parts, and each one treats your data differently. Here is the honest breakdown.

Free tools — format, validate, convert, diff, repair, mind map & more

Stays in your browser

Every free tool runs entirely in your browser — your JSON never leaves your device. There is no upload, no server copy, and no account needed. That includes file conversions like JSON to Excel and Excel to JSON: the file is read and converted right on your device.

The editor also autosaves your work to your browser's own storage, on your device — not to a server. Close the tab and come back; it is still yours alone.

AI Copilot actions — explain, fix, generate test data & more

Masked on your device first

AI actions do send your JSON to our servers — a model cannot read what it never receives. But before anything is sent, sensitive values are detected and masked right on your device: passwords, API keys, tokens, private keys, emails, credit-card numbers, SSNs, and bank account numbers become placeholders like [MASKED_PASSWORD_1]. The AI and our servers see placeholders in place of every detected value; those values never leave your browser. Detection is pattern-based — it catches common key names and high-entropy secrets — so treat masking as a strong safety net rather than an absolute guarantee for unusually named fields. When the result comes back, the placeholders are swapped back locally.

Masking is on by default, and you can toggle it in Settings → Privacy & Data. Two actions — Flatten and Schema generation — are computed on our own server with no external AI involved at all. And the price estimate shown before a run sends only size numbers, never your JSON.

Storage — AI history and projects

Optional — you choose

Saving AI results to your account is optional. Turn off the "Save AI history" toggle and your JSON, previews, and AI results are not stored on our servers — we keep only a content-free billing record of the credits used, never your content. When history is on and masking is on, the saved previews and results contain placeholders, not your real values.

Projects work the same way. Cloud sync is a switch ("Store projects in the cloud"); with it off, new projects stay in your browser only — they carry a "This device" badge and are never uploaded.

What masking looks like

Before an AI request leaves your browser, detected sensitive values are swapped for placeholders — on your device. Those detected values never leave your browser. When the answer comes back, the placeholders are swapped back locally.

What you paste

{
  "email": "maria@example.com",
  "password": "hunter2!",
  "api_key": "sk_live_51H8x…",
  "card_number": "4242 4242 4242 4242"
}

What the AI sees

{
  "email": "[MASKED_EMAIL_1]",
  "password": "[MASKED_PASSWORD_1]",
  "api_key": "[MASKED_API_KEY_1]",
  "card_number": "[MASKED_CARD_1]"
}

Masking detects passwords, API keys, tokens, private keys, email addresses, credit-card numbers, SSNs, and bank account numbers. Detection is pattern-based — a secret hiding under an unusual field name can slip through, so treat masking as a strong safety net, not a guarantee. It is on by default — the switch lives in Settings → Privacy & Data.

Why we built it this way

Pasting JSON into a random website is an act of trust. Your paste often holds more than you think: customer emails, access tokens, payment details. In 2025, security researchers publicly reported popular online formatters that had been storing and leaking users' pasted JSON — data people believed was gone the moment they closed the tab.

Our answer is simple: do the work where the data already is. The free tools do all their work inside your browser, so there is no server copy to store, log, or leak. For AI features, where a server round-trip is unavoidable, we strip out the sensitive parts on your device before anything is sent.

Straight answers, no overselling

We do not claim end-to-end encryption or "we never see your data" for AI actions. During an AI run, our servers do handle your JSON — with the sensitive values already masked by your browser.
The free tools genuinely never send your JSON anywhere. Not masked, not encrypted — simply never sent.
We use standard analytics (page views, feature clicks). Analytics never includes your JSON content.
Every server-touching feature has an off switch: masking, AI history, and cloud projects are all under Settings → Privacy & Data.

Security questions, answered

Yes. The free tools — formatter, validator, converters, diff, repair, mind map, and the rest — run entirely in your browser, so your JSON never leaves your device. AI actions do send data to our servers, but detected sensitive values are masked on your device first, and you can turn off history so your inputs and results are never stored — we keep only a content-free record of credits used.

Try it — nothing to upload

Open the editor and format, validate, or convert your JSON right in your browser. No sign-up required.

Open the Editor