What the 2025 report found
In November 2025 watchTowr Labs published research on two popular online formatters, JSONFormatter.org and CodeBeautify.org[1]. Both let you save what you pasted and share it by link. watchTowr found that saved items were listed on the sites' "Recent Links" pages, which show a title, a description and a date for each save, and that every item could be fetched by its ID[1].
The researchers downloaded more than 80,000 saved submissions, over 5 GB of data, covering about five years of JSONFormatter content and about one year of CodeBeautify content, and then stopped[1]. The items held thousands of secrets: Active Directory and database credentials, cloud keys, private keys, CI/CD and GitHub tokens, an AWS Secrets Manager export, SSH session recordings and customer personal data[1]. Security news sites reported the findings[2].
To see whether anyone else was reading the saved items, the researchers saved fake AWS-style credentials with a tracking token and a 24-hour expiry. They report the first access 48 hours after upload, 24 hours after the credentials had expired[1].
Two limits are worth knowing. The report does not say who made that access, and its figure of about 350,000 saved items on JSONFormatter since launch is an estimate, not a count[1].
Why a save link is risky
A "save and share" button turns what you pasted into a record on someone else's server. That is risky for three reasons:
- The link is the only lock. Anyone who has or finds the address can open it. There is no login.
- A list of recent items makes it public. A link nobody was meant to find becomes one anybody can browse to.
- The copy outlives your tab. It sits in the server's storage, backups and logs, where you cannot delete it.
Even a link that is never published can end up in browser history, chat logs, tickets and referrer headers.
What counts as a secret
More than you might think, and a short snippet is enough:
- passwords, connection strings and database URLs
- API keys, access tokens and JWTs. A JWT can be read by anyone who holds it, and may stay valid until it expires
- private keys and certificates
- config files and
.envcontent - API responses and logs that contain customer data
How to check that a tool really is local
You do not have to take a site's word for it. Your browser lists every request a page makes, and you can watch that list. The step-by-step check for fjordtools takes a minute.
- Open developer tools with F12 (or Ctrl Shift I, ⌘ Option I on a Mac) and choose the Network tab.
- Clear the list.
- Paste harmless sample text and press every button, including Save, Share and Download. A local tool adds no rows. A tool that works on a server adds a request, often a
POST, that carries your text.
Two more checks make the test stronger. Load the page, switch the browser to offline in the Network tab, and use the tool: a local tool keeps working. And repeat the test after a tool changes, because a site can add a save button later.
Test with a made-up sample first. Never use a real credential to find out whether a tool is safe.
If you already pasted something
Treat it as exposed and rotate it: revoke the key, change the password, issue a new token. Deleting the saved item may not remove copies taken in the meantime. Then check the access logs of the affected service for the period since you pasted, and remove the secret from tickets and chats where you shared the link.
How fjordtools handles this
Everything on fjordtools runs in your browser. There is no save or share feature and there are no accounts. After a page has loaded it makes no network requests: the site's Content-Security-Policy sets connect-src 'none', which stops scripts from using fetch, XMLHttpRequest or WebSocket, so even a bug could not send your input out. Loading a page is an ordinary web request; typing into it is not one.
You do not have to believe that either. Run the steps above on any of the tools below. The full policy is on the privacy page.