Paste JSON on the left and see it formatted live on the right as a collapsible tree, with syntax validation and error locating, expand/collapse, minify, escape/unescape and copyable node paths. All processed locally, nothing uploaded.
Merge several JSON objects or .json files into one. Deep merge, shallow merge, array concatenation and de-duplication, a choice of which side wins a conflict, and a list of every field that was overwritten. All local, nothing uploaded.
Convert between Base64 and text, images or any file. Paste a whole data URI and it is detected automatically; decoded images are previewed inline. Everything is converted locally — nothing is uploaded.
Convert Unix timestamps to dates and back. Auto-detects 10-digit (seconds) and 13-digit (milliseconds) input, switches between your local timezone and UTC, and shows the current timestamp live at the top of the page.
Convert between percent-encoded URLs and plain text in both directions, with UTF-8 and GBK support, an option to read + as a space, a choice of encodeURIComponent or encodeURI, and automatic breakdown of every query parameter when you paste a whole link.
What you paste into an online tool while developing is usually far more sensitive than it feels: an API response carrying user phone numbers, a request header with a token in it, a chunk of JSON exported from the production database, a config file you are about to commit. Pasting that into a site that sends the content back to its server hands a slice of live data to a third party you know nothing about — and tools like that often do not even have a privacy policy. Everything here is done with the browser's own capabilities, so the page still works after you disconnect from the network, and you can open the Network panel in devtools and confirm for yourself that no request is made.
This is the most common misconception about this group of tools. Base64 and URL percent-encoding are both a reversible encoding: anyone holding the output can turn it straight back, with no key and nothing to crack. They exist so binary content and special characters can travel safely through protocols that only accept text — they have nothing to do with secrecy. Base64-ing a password before storing it in the database is therefore no different from storing it in plain text, and a token placed in a URL query parameter still shows up intact in gateway logs and browser history no matter how it is encoded. Things that genuinely need to stay secret call for encryption and hashing, which is what a different group of tools is for.
The parser reports where it noticed the problem, not where you made it. Miss a closing brace and the error lands at the end of the file; add one comma too many and it lands on the next key. So when you see a line number, search upwards rather than staring at that line. The three most common causes are not really JSON problems at all: a // comment carried over from source code, single quotes, and a trailing comma after the last item of an object or array — all three are legal in JavaScript and none of them are legal in JSON.
Timestamps in logs and API payloads come as 10 digits or 13: seconds and milliseconds respectively. Parse milliseconds as seconds and you land fifty thousand years in the future; make the opposite mistake and you land somewhere near 1970. It is the single most common trap here, so the converter reads the unit from the digit count automatically and shows you what it decided, rather than making you choose up front.