JSON Formatter & Minifier
Paste JSON → Auto-format → Copy or download. Free, instant, private.
The 6 fundamental JSON data types
How to format and minify JSON in popular languages
Click to load an example into the input
What is JSON?
JSON (JavaScript Object Notation) is a lightweight, text-based data interchange format that is easy for humans to read and write and easy for machines to parse and generate. Defined by the ECMA-404 standard and RFC 8259, JSON has become the most widely used data format on the web, replacing XML in the vast majority of modern APIs.
JSON supports only 6 data types: object, array, string, number, boolean (true/false), and null. There are no date types, comments, or undefined values. This simplicity is its strength: every programming language can parse and serialize JSON trivially.
Why Format JSON?
JSON from APIs is typically sent minified — everything on a single line with no whitespace. For large responses with thousands of fields, reading raw minified JSON is virtually impossible. A JSON formatter adds line breaks and indentation, transforming an unreadable wall of text into a clear hierarchical structure.
- API debugging: Quickly locate specific fields in complex nested responses
- Config review: Read
package.json,tsconfig.json, or CI/CD configs with clarity - Data comparison: Formatted JSON makes diff and comparison tools far more accurate
- Documentation: Pretty-printed JSON is essential for API docs and technical guides
Format vs Minify: When to Use Which
Formatting (Pretty Print) is for human consumption: debugging, code review, documentation. Minifying is for machines: network transmission, database storage, API responses. Minifying strips all unnecessary whitespace, significantly reducing payload size — especially important for large datasets.
| Mode | Best for | Size impact |
|---|---|---|
Format (2 spaces) | Debugging, code review, docs | 30-50% larger |
Format (4 spaces) | Config files, Python projects | 40-60% larger |
Format (tab) | Tab-indent projects, Go | 35-55% larger |
Minify | APIs, transmission, storage | Smallest possible |
Common JSON Errors and How to Fix Them
- Trailing comma: JSON does not allow a comma after the last element.
{"a": 1,}is invalid. JavaScript and TypeScript allow trailing commas, but strict JSON does not. - Single quotes: JSON requires double quotes
""around strings and keys. Single quotes''are invalid. - Comments: JSON has no comment syntax. If you need comments, use JSONC (JSON with Comments) but strip them before parsing.
- Unquoted keys: All keys must be wrapped in double quotes.
{name: "Alice"}is invalid JSON — use{"name": "Alice"}instead. - Undefined/NaN/Infinity: These JavaScript values do not exist in JSON. Use
nullinstead ofundefined, and represent special numbers as strings.
JSON.parse() and JSON.stringify() in JavaScript
JSON.parse(str) converts a JSON string into a JavaScript object. JSON.stringify(obj, replacer, space) converts an object back to a JSON string. The space parameter controls indentation: pass 2 for 2-space indent, 4 for 4-space, or "\t" for tab indentation.
The replacer parameter lets you filter or transform values during serialization. Pass an array of key names to include only those keys, or pass a function for custom transformation logic.
JSON in the Web Development Ecosystem
REST APIs: The overwhelming majority of REST APIs return JSON with the Content-Type: application/json header. GraphQL also uses JSON for both requests and responses.
Configuration: package.json (npm/yarn), tsconfig.json (TypeScript), .eslintrc.json (ESLint), composer.json (PHP), appsettings.json (.NET) — all are JSON files that benefit from proper formatting.
Databases: MongoDB stores data as BSON (Binary JSON). PostgreSQL offers the jsonb type for efficient JSON querying. DynamoDB and Firestore are also built on JSON-like document structures.
JSON Security Considerations
Never use eval() to parse JSON — it executes arbitrary code and is a critical security vulnerability. Always use JSON.parse(), which safely parses the string without code execution. When accepting JSON from untrusted sources, validate the structure and types before processing.
Be aware of JSON injection: if you dynamically construct JSON strings by concatenating user input, an attacker can break out of a string value and inject additional keys. Always use proper serialization (JSON.stringify) instead of string concatenation.
About Developer Tools
Developer tools automate the repetitive parts of software work: formatting JSON, encoding/decoding Base64, decoding JWTs to verify token claims, generating UUIDs, formatting XML, diffing configurations. These aren't glamorous tasks, but they're the friction points that eat 10-15 minutes multiple times a day — adding up to hours weekly. Running them in a clean browser tab beats wrestling with CLI dependencies or IDE extensions that might ship your private data to a third party.
Why it matters
Fast, client-side developer tools fundamentally matter because they're used with sensitive data. JWT tokens contain user identity. Base64 payloads might encode API keys. JSON dumps include customer records. If a 'developer tool' sends your input to a server to process, you've just leaked production secrets. ZestLab's dev tools run 100% client-side with no network calls after page load — what you paste stays in your browser.
Privacy and safety
All developer tools here execute in-browser using pure JavaScript. There's no 'decode server' or 'format API' — your JWT, your JSON, your encoded payload is parsed by code running on your laptop. Verify this yourself with browser DevTools → Network tab: you'll see zero outbound requests when using any tool. That's a standard we hold because dev tools handle secrets.
Best practices
- Never paste production JWT or API tokens into ANY online tool without verifying it runs client-side (check the Network tab)
- Use browser private/incognito mode for one-off decoding of sensitive payloads
- Bookmark tools you use daily — ZestLab tool URLs are stable and don't require accounts
- When formatting JSON with secrets for team review, redact credentials before sharing the formatted output