The JSONFormatter & CodeBeautify Data Leak: What Developers Need to Know

In November 2025, security researchers at watchTowr Labs revealed that JSONFormatter.org and CodeBeautify.org had been quietly storing user-submitted data on their servers for years — and that data was accessible. Over 80,000 files totalling 5 GB were exposed, containing passwords, API keys, SSH private keys, OAuth tokens, and Active Directory credentials from organisations across banking, healthcare, government, and telecoms.

The incident was covered by The Hacker News, BleepingComputer, and Help Net Security. Active exploits against the exposed credentials appeared within 48 hours of publication.

This article explains what happened, why it happened architecturally, and how to verify whether any online tool is safe before you paste anything sensitive into it.

What Was Exposed

According to the watchTowr Labs investigation, the exposed data included:

• Passwords and credentials pasted into the formatter (database connection strings, admin passwords)
• API keys and secrets (AWS access keys, Stripe keys, SendGrid API tokens, GitHub tokens)
• SSH private keys
• OAuth 2.0 access tokens and refresh tokens
• Active Directory credentials from enterprise environments
• Cloud provider credentials (AWS, GCP, Azure service account keys)
• JWT tokens containing user identity and session data

These are not theoretical risks. Developers routinely paste real configuration files, environment variables, and API responses into formatters to debug them. A .env file formatted once in 2022 could still be sitting in a server database in 2025.

Why It Happened: The Server-Side Architecture Problem

The root cause is architectural. Both JSONFormatter.org and CodeBeautify.org process user input on their servers. When you click "Format", your data is sent via an HTTP request to their backend, processed, and returned. Some features — save-and-share, history, collaboration — required storing that data persistently in a database.

This is the data flow for a server-side formatter:

Your browser → [POST /format] → Their server → Database
                                      ↓
                              Formatted JSON
                                      ↓
               Their server → [Response] → Your browser

The data reached their server. Once it's there, its security depends entirely on their database access controls, retention policies, and whether their infrastructure gets compromised. In this case, years of user data accumulated with insufficient access controls, and the exposure was discovered from the outside — not disclosed by the sites themselves.

This is the data flow for a client-side formatter:

Your browser → JavaScript formats the JSON locally
                        ↓
               Formatted JSON displayed
               (no network request made)

There is no server request. The data never leaves your device. Even if the tool's domain were compromised, an attacker would find nothing — there is no data to steal because none was ever sent.

How to Verify Any Online Tool in 10 Seconds

You don't have to take a tool's word for it. You can verify the architecture yourself using your browser's built-in developer tools:

1. Open the tool in your browser.
2. Press F12 (Windows/Linux) or Cmd+Option+I (macOS) to open DevTools.
3. Click the Network tab.
4. Click the Clear button (⊘) to remove existing entries.
5. Paste some text into the tool and trigger its action (Format, Encode, Decode, etc.).
6. Watch the Network tab.

Safe (client-side): No new entries appear in the Network tab. All processing happened locally in your browser's JavaScript engine.

Unsafe (server-side): A new request appears — typically a POST or GET — and if you click it, you'll see your pasted data in the request payload.

This test is definitive. It doesn't require trusting any privacy policy or marketing claim.

The Broader Pattern: Why This Keeps Happening

The JSONFormatter and CodeBeautify leak is not unique. Server-side developer tools have a structural incentive problem:

• Storage is cheap. Keeping user data costs almost nothing, so it accumulates indefinitely.
• There's no deletion pressure. Users don't know their data is stored, so they don't request deletion.
• Security audits are rare. Small tools operated by individuals or small teams rarely undergo professional security audits.
• The attack surface grows silently. A tool that processed 1 million formatting requests over five years has a database containing data from 1 million sessions — most of which the users have forgotten about.

The only architectural defense is to not process user data server-side in the first place. If the data is never sent to a server, it cannot be stored, breached, or subpoenaed.

What to Use Instead

For the tools that JSONFormatter and CodeBeautify provided, there are fully client-side alternatives that pass the Network tab test:

Every tool on DevEssentials runs entirely in your browser. There is no backend — no server receives your input, no database stores it. You can verify this yourself with the Network tab test above. Once the page has loaded, the tools work completely offline.

If You Used JSONFormatter or CodeBeautify

If you pasted sensitive data into either site — configuration files, environment variables, API responses containing keys, JWTs, database connection strings — treat those credentials as compromised:

1. Rotate all API keys that appeared in anything you formatted on either site.
2. Revoke OAuth tokens that may have been in formatted JSON payloads.
3. Regenerate SSH keys if any private keys were pasted.
4. Change passwords visible in any formatted configuration files.
5. Audit your cloud provider (AWS, GCP, Azure) for any activity from credentials that could have been exposed.

Active exploits against credentials from the leaked data were reported within 48 hours of the watchTowr Labs disclosure. If the data was in the leak, it should be considered already tested by attackers.

Need a safe JSON formatter that never sends your data anywhere? Open the DevEssentials JSON Formatter →