Privacy

Your document is not transmitted to us

Formatting, minifying, validating, diffing, the tree view and the JSONPath query all run on your machine. There is no upload endpoint, no backend, no account system and no database behind this site. The page you are reading is a static file.

The processing happens in a Web Worker inside this tab (assets/worker.js, loading assets/engine.js). Worker messages never cross the origin, so no request made by the tools carries your document anywhere. The engine source ships with the page: open assets/engine.js — a plain file at the same origin as this page, no build step and no login — and search for fetch, XMLHttpRequest or sendBeacon; there is one fetch, described below, and it is not in the formatting path.

There is no save or share feature here, and that is the more important half of this page: the 2025 leak affecting other formatters happened because those sites stored what visitors pasted behind a guessable link, not because a paste was uploaded. Nothing here writes your document anywhere — no saved snippet, no share URL, no recent-items list — so there is no address for anyone to walk.

The one exception: schema by URL

On the Schema tab you can either paste a schema or name a URL for one. If you choose the URL, your browser requests that URL from its own host. We are not in the middle of that: the request carries no copy of your document, only the address you typed, and we never see it or its response.

If you do not want that request to exist, paste the schema instead. Nothing else on the site fetches anything.

Who does see something

These files are delivered by GitHub Pages from an IP in 185.199.108.0/22. Like every web server, GitHub's edge records the standard request line: your IP address, user agent string, the path requested, a timestamp and the Referer header if your browser sent one. That log exists whether or not you paste anything into a tool, because requesting the page is what makes the page appear.

If you open a page through a search engine, the search engine also knows you asked. That is on their side, not ours.

Ads and consent

This site is served with Google AdSense enabled. Adverts come from pagead2.googlesyndication.com and googleadservices.com, so your browser talks to Google when you load a page here — that is a third-party request, and it is visible in a network panel. We have reworded every sentence that would stop being true, rather than keep it.

Google uses cookies to serve ads based on your prior visits to this or other sites. The Google advertising cookie lets Google and its partners use data for ad targeting. You can opt out at https://www.google.com/settings/ads or at https://www.aboutads.info/choices, and Google's own policy on what it collects is at https://policies.google.com/technologies/partner-sites.

In the EEA, the UK and Switzerland you should see a consent message before any personalised advertising. If you do not see one, your region may not require it here, or the message was dismissed; either way the amount of data shared with Google is governed by that consent choice, not by anything on this site.

Revenue from ads does not change what the tools do with your input: nothing about the formatting path moves because an advert is on the page.

Analytics

This build ships no analytics of any kind; if one is ever added, the request shows up in your own network panel and this paragraph gets rewritten. Nothing measures which documents you format, what you search for, or how long you stay — a page counter would need a request to whoever serves it, and this site makes none for that purpose. If a network panel on a page here shows the page's own files plus the ad tag — and nothing that carries your document — that is the whole story.

Cookies and storage

This site sets no cookies of its own and keeps nothing in localStorage or IndexedDB. Your input is not remembered if you reload: it stays in a textarea until the tab goes away. With advertising enabled, Google may set cookies on its own domains; those are theirs to read, not ours.

Feedback

The quiet link next to a parse error, and the one in the footer of every page, opens a new issue on https://github.com/george-poe/jsonprobe-com with a short note already typed in it: the page path, the length of your input in bytes, how long the run took, and the error message exactly as this page printed it. It is an ordinary link, so there is no separate submission channel for feedback: what appears in the form is what the link put there, on screen before anything is sent, and you can read it, change it, or delete it.

One limit stated plainly rather than glossed: an error message can quote a short fragment of what you pasted, because that is what makes an error message useful. Those fields are length-capped for that reason and the document is never attached whole. If a fragment in the pre-filled note is sensitive, cut it before sending — once sent, the issue is public and GitHub keeps it under its own terms, not ours.

The repository is where these pages and their tests are built, so a report lands next to the code that would have to change. Nobody but the person who builds this site reads it.

The footer of every page also lists a mailbox, feedback@jsonprobe.com. It is a different channel with different properties: nothing is generated into it. There is no page path, no byte count, no error text in the envelope — whatever arrives is only what you typed, which is why a useful mail usually quotes the error itself. Mail to that address is relayed by Cloudflare Email Routing to an outside mailbox; the pages still send nothing, and no request this site makes carries your document.