Every dev pastes API responses into some random formatter. After reading about 80,000+ saved pastes (credentials, keys) found on two popular formatter sites in 2025, I wanted to know what actually happens when you press Format. I'm the author of one of the tools (PasteKit), so treat that as a bias. To keep it fair, I scripted a headless browser: it types a unique marker into each editor, presses Format/Validate, and logs every request, request body and WebSocket frame, then searches for the marker. Results (12 Oct 2026): None of the six I could fully test sent my JSON anywhere when formatting. Third-party hosts contacted: JSONFormatter.org about 260, CodeBeautify about 300–375 (mostly ads), JSON Crack 5, privatejson.app 2, PasteKit 2, Jsony 1. The risk is mostly in "Save/Share" features, which store your content on their servers, and in how much third-party code a page runs. JSONLint and Curious Concept I couldn't drive (a lazy editor and a bot block), so I list them as "not verified" instead of guessing. You can repeat it on any tool in two minutes: open DevTools, Network tab, paste a made-up marker, press every button, and search the Network panel for it. I wrote the steps and the full table here: https://pastekit.dev/guides/private-json-formatters-compared Happy to hear what I got wrong, which tools I should add, and whether my method misses something.   submitted by   /u/Important-Routine649 [link]   [comments]