A local workbench for sensitive JSON.

The principle

A JSON tool should not need a copy of your production payload. PayloadBench keeps core inspection workflows in the browser and makes that processing boundary testable.

Open DevTools -> Network while using a core tool and check that no request contains your pasted input. Normal site delivery can still use network requests.

Why PayloadBench was built

In November 2025, security researchers at watchTowr revealed that jsonformatter.org and codebeautify.org - two of the most popular online JSON tools - had been leaking user data for over five years. An unprotected feature exposed 80,000+ code snippets containing AWS access keys, GitHub personal access tokens, database passwords, and banking PII. Attackers were actively harvesting the data within 48 hours of the discovery.

Around the same time, the most popular JSON Formatter Chrome extension - with over 2 million users - was sold to a new owner. The extension was closed-sourced and injected with tracking scripts, checkout popups, and a hardcoded API key for harvesting user location data.

PayloadBench was built as a direct response: keep core JSON workflows browser-local and make the pasted-content boundary easy to verify.

How it works

PayloadBench is a web application built with Next.js and Tailwind CSS, deployed on Cloudflare. Core JSON formatting, validation, diff comparison, JWT decoding, JSONPath evaluation, and schema validation run in browser JavaScript for pasted input. Normal site delivery may still use network requests.

Product information and public updates are available on GitHub. The browser-local processing boundary can be verified independently with the browser Network panel.

Operated by SlowGrowth, Hong Kong

PayloadBench is developed, maintained, and operated by SlowGrowth, Hong Kong. It is a first-party browser-based developer utility focused on verifiable browser-local workflows.

PayloadBench does not provide cryptocurrency, token issuance, stored-value credits, financial services, file hosting or sharing, marketplace services, or third-party payment processing. JWT decoding is limited to local inspection of authentication data.

Contact

For product, billing, privacy, or security questions, email support@payloadbench.org. Non-sensitive reproducible bugs may also be reported through the GitHub issue tracker.