A local workbench for sensitive JSON.

The principle

A JSON tool should not need a copy of your production payload. PayloadBench keeps core inspection workflows in the browser and makes that processing boundary testable.

Open DevTools -> Network while using a core tool and check that no request contains your pasted input. Normal site delivery can still use network requests.

Why PayloadBench was built

In November 2025, security researchers at watchTowr revealed that jsonformatter.org and codebeautify.org - two of the most popular online JSON tools - had been leaking user data for over five years. An unprotected feature exposed 80,000+ code snippets containing AWS access keys, GitHub personal access tokens, database passwords, and banking PII. Attackers were actively harvesting the data within 48 hours of the discovery.

Around the same time, the most popular JSON Formatter Chrome extension - with over 2 million users - was sold to a new owner. The extension was closed-sourced and injected with tracking scripts, checkout popups, and a hardcoded API key for harvesting user location data.

PayloadBench was built as a direct response: keep core JSON workflows browser-local and make the pasted-content boundary easy to verify.

How it works

PayloadBench is a web application built with Next.js and Tailwind CSS, deployed on Cloudflare. Core JSON formatting, validation, diff comparison, JWT decoding, JSONPath evaluation, and schema validation run in browser JavaScript for pasted input. Normal site delivery may still use network requests.

Product information and public updates are available on GitHub. The browser-local processing boundary can be verified independently with the browser Network panel.

Built by JSON-Lee

PayloadBench is developed and maintained by JSON-Lee, an independent developer who builds verifiable browser-local tools. The project is self-funded and independent - no venture capital, no external investors, no corporate parent company.

Being independent means we answer only to our users. There is no pressure to monetize through data collection, advertising, or tracking. The business model is straightforward: core tools are free forever, and Pro features are currently free during Launch Access while preserving the no pasted-content upload boundary for core tool inputs.

Contact

For questions, feedback, or bug reports, open an issue on GitHub. For security-sensitive matters, refer to the repository's security policy.