https://jsontoexcel.net/chunk-SUE353AT.js

1import{a as g}from"./chunk-FY3C2FL4.js";import{g as p}from"./chunk-25Q6C272.js";import{b as h}from"./chunk-RWDG3UKW.js";import"./chunk-WH7DPHUN.js";import"./chunk-2HQDRHHR.js";import{Pa as n,Qa as t,Qb as d,Ra as s,Tb as c,Ub as m,jb as e,qa as o,va as l}from"./chunk-K57J5MTO.js";var f=class r{constructor(a,i,u){this.meta=a;this.titleService=i;this.structuredData=u;this.titleService.setTitle("Are Online JSON Converters Safe? How to Verify | jsontoexcel.net"),this.meta.updateTag({name:"description",content:"Client-side or server-side? Use the DevTools Network tab and a canary value to prove where your JSON actually goes, plus what you should never paste online."}),this.structuredData.setArticleSchema("are-online-json-converters-safe")}static \u0275fac=function(i){return new(i||r)(o(c),o(m),o(h))};static \u0275cmp=l({type:r,selectors:[["app-blog-online-json-converter-safety"]],decls:264,vars:0,consts:[[1,"article-wrapper"],[1,"article-header"],[1,"article-breadcrumb"],["routerLink","/"],["routerLink","/blog/"],[1,"article-meta"],[1,"article-category"],[1,"article-byline"],["routerLink","/author/arslan-malik"],["datetime","2026-09-06"],[1,"article-content"],[1,"info-box"],["routerLink","/privacy-policy"],[1,"warning-box"],["routerLink","/blog/json-to-excel-python/"],["routerLink","/blog/excel-power-query-json-import/"],[1,"article-cta"],[1,"article-footer"]],template:function(i,u){i&1&&(n(0,"article",0)(1,"header",1)(2,"nav",2)(3,"a",3),e(4,"Home"),t(),n(5,"span"),e(6,"\u203A"),t(),n(7,"a",4),e(8,"Blog"),t(),n(9,"span"),e(10,"\u203A"),t(),n(11,"span"),e(12,"Are Online Converters Safe?"),t()(),n(13,"div",5)(14,"span",6),e(15,"Guide"),t(),n(16,"span"),e(17,"\xB7"),t(),n(18,"span",7),e(19,"By "),n(20,"a",8),e(21,"Arslan Malik"),t()(),n(22,"span"),e(23,"\xB7"),t(),n(24,"time",9),e(25,"September 6, 2026"),t(),n(26,"span"),e(27,"\xB7"),t(),n(28,"span"),e(29,"9 min read"),t()(),n(30,"h1"),e(31,"Are Online JSON Converters Safe? How to Check Before You Paste"),t(),n(32,"p"),e(33,`"We don't store your data" is a claim, not a guarantee. Here is how to verify what a converter actually does with your file \u2014 in about ninety seconds, using tools already in your browser.`),t()(),n(34,"div",10)(35,"p"),e(36," I run one of these tools, so treat what follows with appropriate suspicion. That is rather the point: you should not have to trust me, or any other converter, on the strength of a sentence in a footer. You should be able to check. This article is about how. "),t(),n(37,"h2"),e(38,"The distinction that matters"),t(),n(39,"p"),e(40,"Every browser-based converter falls into one of two categories."),t(),n(41,"p")(42,"strong"),e(43,"Client-side."),t(),e(44," The conversion runs in JavaScript inside your browser tab. Your data is read into memory on your own machine, transformed, and offered back as a download. It never travels over the network. The operator could not read it if they wanted to, because it never reached them. "),t(),n(45,"p")(46,"strong"),e(47,"Server-side."),t(),e(48,' Your file is uploaded, processed on a machine somewhere, and the result sent back. Now the operator has had a complete copy of your data. What happens next depends entirely on their policies, their logging, their backups, their security posture, and their honesty. Server access logs, error trackers and CDN caches routinely retain request bodies for days regardless of what the privacy policy says about "storage". '),t(),n(49,"p"),e(50," Both designs are legitimate. Server-side is sometimes necessary \u2014 for formats that need heavy dependencies, or for files too large for browser memory. But you should know which one you are using before you paste, and the answer is almost never on the page. "),t(),n(51,"h2"),e(52,"Check 1: Watch the network"),t(),n(53,"p"),e(54,"This is definitive, and it takes under a minute."),t(),n(55,"ol")(56,"li"),e(57,"Open the converter page."),t(),n(58,"li"),e(59,"Press "),n(60,"strong"),e(61,"F12"),t(),e(62," (or Cmd+Option+I on macOS) to open developer tools."),t(),n(63,"li"),e(64,"Go to the "),n(65,"strong"),e(66,"Network"),t(),e(67," tab and clear the log."),t(),n(68,"li"),e(69,"Paste some harmless test JSON and run the conversion."),t(),n(70,"li"),e(71,"Look at what appeared in the list."),t()(),n(72,"p"),e(73," If the conversion is client-side, you will see nothing new, or only anal

1ytics and ad requests. If your data was uploaded, a "),n(74,"code"),e(75,"POST"),t(),e(76," or "),n(77,"code"),e(78,"PUT"),t(),e(79," request will be sitting there. Click it, open the "),n(80,"strong"),e(81,"Payload"),t(),e(82," or "),n(83,"strong"),e(84,"Request"),t(),e(85," tab, and you will see your JSON in the body. "),t(),n(86,"p"),e(87,"Use recognisable test data so you can spot it instantly:"),t(),n(88,"pre")(89,"code"),e(90,'[{"canary": "PLEASE-DO-NOT-UPLOAD-ME-12345"}]'),t()(),n(91,"p"),e(92," Then use the Network panel's filter box to search for "),n(93,"code"),e(94,"canary"),t(),e(95,". A hit means your data left the machine. This works even if the request is compressed or buried among dozens of others. "),t(),n(96,"div",11)(97,"p")(98,"strong"),e(99,"Try it on this site."),t(),e(100," Open the "),n(101,"a",3),e(102,"converter"),t(),e(103," with the Network tab recording and convert that canary object. You will not find a request carrying it, because the conversion runs in your browser. Do not take my word for it \u2014 that is the entire point of the exercise. "),t()(),n(104,"h2"),e(105,"Check 2: Pull the plug"),t(),n(106,"p"),e(107," The blunt version of the same test. Load the converter page, then disconnect from the network \u2014 turn off Wi-Fi, or use the throttling dropdown in DevTools and select "),n(108,"strong"),e(109,"Offline"),t(),e(110,". Now try to convert something. "),t(),n(111,"p"),e(112," If it still works, the processing is happening locally, because there is nowhere else for it to happen. If it fails or hangs, your data was going somewhere. "),t(),n(113,"p"),e(114,' This test has one wrinkle: a page that loads code lazily may fail offline for innocent reasons. If it breaks, reconnect and fall back to Check 1, which distinguishes "fetched a script" from "uploaded your data". '),t(),n(115,"h2"),e(116,"Check 3: Read the privacy policy for the right things"),t(),n(117,"p"),e(118," Most policies are boilerplate. A few phrases are worth locating specifically, and their absence is as informative as their presence. "),t(),n(119,"table")(120,"thead")(121,"tr")(122,"th"),e(123,"Look for"),t(),n(124,"th"),e(125,"What it tells you"),t()()(),n(126,"tbody")(127,"tr")(128,"td"),e(129,'"processed in your browser", "client-side", "never uploaded"'),t(),n(130,"td"),e(131,"A specific, falsifiable claim \u2014 verify it with Check 1"),t()(),n(132,"tr")(133,"td"),e(134,'"files are deleted after 1 hour"'),t(),n(135,"td"),e(136,"Server-side by definition. Deletion is a promise, not a property"),t()(),n(137,"tr")(138,"td"),e(139,"No mention of uploaded content at all"),t(),n(140,"td"),e(141,"Nothing has been committed to. Assume the worst"),t()(),n(142,"tr")(143,"td"),e(144,'"we may share data with partners"'),t(),n(145,"td"),e(146,"Read the surrounding clause carefully before pasting anything"),t()(),n(147,"tr")(148,"td"),e(149,"A named operator and a working contact address"),t(),n(150,"td"),e(151,"Someone is accountable. Weak signal, but a real one"),t()()()(),n(152,"p"),e(153," Ours is at "),n(154,"a",12),e(155,"privacy policy"),t(),e(156,", and it says the conversion happens in your browser. So does everyone else's marketing copy. Check 1 is what separates the two. "),t(),n(157,"h2"),e(158,"What you should never paste anywhere"),t(),n(159,"p"),e(160," Even into a tool you have verified. Client-side processing protects the data in transit and at rest on someone else's server; it does not protect you from a shoulder surfer, a compromised browser extension with page access, a shared screen, or a future version of the page that behaves differently. "),t(),n(161,"ul")(162,"li")(163,"strong"),e(164,"Credentials of any kind"),t(),e(165," \u2014 API keys, tokens, passwords, connection strings. These frequently ride along inside JSON config files."),t(),n(166,"li")(167,"strong"),e(168,"Personal data you are the custodian of"),t(),e(169," \u2014 customer names, email addresses, phone numbers, addresses. Under GDPR and similar regimes, pasting this into a third-party tool is a processing activity you are answerable for, whether or not it was ever transmitted."),t(),n(170,"li")(171,"strong"),e(172,"Health, financial or biometric records."),t(),e(173," Regulated categories with specific handling requirements that no free web tool is going to satisfy on your behalf."),t(),n(174,"li")(175,"strong"),e(176,"Anything under an NDA or classified by your employer."),t(),e(177," The relevant question is not whether the tool is safe, but whether you are permitted to use it. Those are different questions with different answers."),t()(),n(178,"div",13)(179,"p")(180,"strong"),e(181,"Browser extensions see everything you paste."),t(),e(182,' An extension with "read and change data on all sites" permission can read the contents of any page, including text you typed into it, regardless of whether the site itself uploads anything. If you handle sensitive data, do it in a browser profile with no extensions installed. This risk is independent of which converter you choose. '),t()(),n(183,"h2"),e(184,"Redact first, convert second"),t(),n(185,"p"),e(186," Most of the time you do not need the real values. You are checking a structure, debugging a shape, or building a template. Strip the content and keep the schema: "),t(),n(187,"pre")(188,"code"),e(189,`import json
2
3def redact(node):
4    if isinstance(node, dict):
5        return {k: redact(v) for k, v in node.items()}
6    if isinstance(node, list):
7        return [redact(v) for v in node[:3]]   # keep the shape, drop the volume
8    if isinstance(node, str):
9        return "x" * min(len(node), 8)
10    if isinstance(node, bool) or node is None:
11        return node
12    return 0
13
14with open("real.json", encoding="utf-8") as f:
15    data = json.load(f)
16
17with open("safe.json", "w", encoding="utf-8") as f:
18    json.dump(redact(data), f, indent=2)`),t()(),n(190,"p"),e(191," Keys, nesting and types survive; values do not. That is enough to test any converter, share a reproduction case in a bug report, or ask a colleague what is wrong with your structure. "),t(),n(192,"h2"),e(193,"When to 

18stay offline entirely"),t(),n(194,"p"),e(195," For regulated or contractually restricted data, the correct answer is not a better website. Use something that never involves a browser at all: "),t(),n(196,"table")(197,"thead")(198,"tr")(199,"th"),e(200,"Tool"),t(),n(201,"th"),e(202,"Good for"),t()()(),n(203,"tbody")(204,"tr")(205,"td"),e(206,"Python with pandas"),t(),n(207,"td"),e(208,"Repeatable conversions, full control over types \u2014 see "),n(209,"a",14),e(210,"the Python guide"),t()()(),n(211,"tr")(212,"td"),e(213,"Excel Power Query"),t(),n(214,"td"),e(215,"No install, already approved in most corporate environments \u2014 "),n(216,"a",15),e(217,"walkthrough"),t()()(),n(218,"tr")(219,"td"),e(220,"jq"),t(),n(221,"td"),e(222,"Inspecting and reshaping on the command line"),t()(),n(223,"tr")(224,"td"),e(225,"VS Code"),t(),n(226,"td"),e(227,"Formatting and validating without leaving your editor"),t()()()(),n(228,"p"),e(229," Power Query deserves particular mention for corporate use: it is part of Excel, so it needs no approval, no install, and no exception request. For a lot of people that makes it the only viable option regardless of what any web tool promises. "),t(),n(230,"h2"),e(231,"A short checklist"),t(),n(232,"ol")(233,"li"),e(234,"Would a leak of this specific data matter? If no, stop worrying and convert it."),t(),n(235,"li"),e(236,"If yes, run the canary test with DevTools open."),t(),n(237,"li"),e(238,"If the tool is client-side and the data is genuinely sensitive, redact anyway, or work offline."),t(),n(239,"li"),e(240,"If the tool is server-side and the data is sensitive, work offline. No policy text changes this."),t(),n(241,"li"),e(242,"Whatever you choose, do it in a browser profile without extensions."),t()(),n(243,"p"),e(244," The general principle is worth more than any specific recommendation: prefer tools whose claims you can verify over tools that ask you to trust them. That applies to this one too. "),t(),n(245,"div",16)(246,"h3"),e(247,"Verify, then convert"),t(),n(248,"p"),e(249,"Open DevTools, watch the Network tab, and convert your JSON. Nothing you paste leaves your browser \u2014 check for yourself."),t(),n(250,"a",3),e(251,"Open the C

18onverter \u2192"),t()()(),s(252,"app-author-bio"),n(253,"footer",17)(254,"p"),e(255,"Published "),n(256,"time",9),e(257,"September 6, 2026"),t(),e(258," by "),n(259,"a",8),e(260,"Arslan Malik"),t()(),n(261,"p")(262,"a",4),e(263,"\u2190 Back to Blog"),t()()()())},dependencies:[d,p,g],styles:[".article-wrapper[_ngcontent-%COMP%]{max-width:760px;margin:32px auto;padding:48px 32px;background:#fff;border-radius:24px;box-shadow:0 24px 48px #0f172a14;color:#1f2937;line-height:1.8;font-family:Segoe UI,Inter,-apple-system,BlinkMacSystemFont,sans-serif}.article-header[_ngcontent-%COMP%]{margin-bottom:36px;border-bottom:1px solid #f1f5f9;padding-bottom:24px}.article-breadcrumb[_ngcontent-%COMP%]{display:flex;align-items:center;gap:8px;font-size:.85rem;color:#9ca3af;margin-bottom:16px}.article-breadcrumb[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]{color:#2563eb;text-decoration:none;font-weight:500}.article-breadcrumb[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]:hover{text-decoration:underline}.article-meta[_ngcontent-%COMP%]{display:flex;align-items:center;gap:8px;font-size:.85rem;color:#9ca3af;margin-bottom:16px}.article-byline[_ngcontent-%COMP%]{color:#64748b;font-weight:600}.article-byline[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]{color:#2563eb;text-decoration:none}.article-byline[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]:hover{text-decoration:underline}.article-meta[_ngcontent-%COMP%]{flex-wrap:wrap}.article-footer[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]{color:#2563eb;text-decoration:none}.article-footer[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]:hover{text-decoration:underline}.article-category[_ngcontent-%COMP%]{display:inline-block;font-size:.75rem;font-weight:600;text-transform:uppercase;letter-spacing:.05em;color:#2563eb;background:#eff6ff;padding:4px 12px;border-radius:20px}.article-header[_ngcontent-%COMP%]   h1[_ngcontent-%COMP%]{margin:0 0 16px;font-size:2.2rem;font-weight:700;color:#0f172a;line-height:1.25}.article-content[_ngcontent-%COMP%]   h2[_ngcontent-%COMP%]{margin:36px 0 16px;font-size:1.5rem;font-weight:700;color:#111827}.article-content[_ngcontent-%COMP%]   h3[_ngcontent-%COMP%]{margin:28px 0 12px;font-size:1.2rem;font-weight:600;color:#1f2937}.article-content[_ngcontent-%COMP%]   p[_ngcontent-%COMP%]{margin:0 0 16px;font-size:1rem;color:#374151}.article-content[_ngcontent-%COMP%]   ul[_ngcontent-%COMP%], .article-content[_ngcontent-%COMP%]   ol[_ngcontent-%COMP%]{margin:12px 0 20px 24px;padding:0}.article-content[_ngcontent-%COMP%]   li[_ngcontent-%COMP%]{margin-bottom:8px;color:#374151}.article-content[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]{color:#2563eb;text-decoration:none;font-weight:500}.article-content[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]:hover{text-decoration:underline}.article-content[_ngcontent-%COMP%]   strong[_ngcontent-%COMP%]{color:#111827}.article-content[_ngcontent-%COMP%]   code[_ngcontent-%COMP%]{background:#f1f5f9;color:#1e293b;padding:2px 6px;border-radius:4px;font-size:.9em;font-family:Cascadia Code,Fira Code,monospace}.article-content[_ngcontent-%COMP%]   pre[_ngcontent-%COMP%]{background:#1e293b;color:#e2e8f0;padding:20px 24px;border-radius:12px;overflow-x:auto;font-size:.9rem;line-height:1.6;margin:16px 0 24px}.article-content[_ngcontent-%COMP%]   pre[_ngcontent-%COMP%]   code[_ngcontent-%COMP%]{background:none;color:inherit;padding:0;font-size:inherit}.article-content[_ngcontent-%COMP%]   blockquote[_ngcontent-%COMP%]{border:1px solid #dbeafe;background:#f8fafc;padding:16px 20px;margin:16px 0 24px;border-radius:8px;color:#475569;font-style:italic}.article-content[_ngcontent-%COMP%]   table[_ngcontent-%COMP%]{width:100%;border-collapse:collapse;margin:16px 0 24px;font-size:.95rem}.article-content[_ngcontent-%COMP%]   table[_ngcontent-%COMP%]   th[_ngcontent-%COMP%]{background:#f8fafc;font-weight:600;text-align:left;padding:10px 14px;border:1px solid #e2e8f0;color:#1e293b}.article-content[_ngcontent-%COMP%]   table[_ngcontent-%COMP%]   td[_ngcontent-%COMP%]{padding:10px 14px;border:1px solid #e2e8f0;color:#374151}.article-content[_ngcontent-%COMP%]   table[_ngcontent-%COMP%]   tr[_ngcontent-%COMP%]:nth-child(2n){background:#fafafa}.info-box[_ngcontent-%COMP%]{background:#eff6ff;border:1px solid #bfdbfe;border-radius:12px;padding:16px 20px;margin:16px 0 24px;color:#1e40af;font-size:.95rem}.info-box[_ngcontent-%COMP%]   strong[_ngcontent-%COMP%]{color:#1e40af}.warning-box[_ngcontent-%COMP%]{background:#fffbeb;border:1px solid #fde68a;border-radius:12px;padding:16px 20px;margin:16px 0 24px;color:#92400e;font-size:.95rem}.article-cta[_ngcontent-%COMP%]{background:#f8fafc;border:1px solid #e2e8f0;border-radius:16px;padding:28px;margin-top:40px;text-align:center}.article-cta[_ngcontent-%COMP%]   h3[_ngcontent-%COMP%]{margin:0 0 8px;font-size:1.2rem;font-weight:700;color:#0f172a}.article-cta[_ngcontent-%COMP%]   p[_ngcontent-%COMP%]{margin:0 0 16px;color:#6b7280;font-size:.95rem}.article-cta[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]{display:inline-block;background:#1e293b;color:#fff;text-decoration:none;padding:10px 24px;border-radius:10px;font-weight:600;font-size:.95rem;transition:background .2s ease}.article-cta[_ngcontent-%COMP%]   a[_ngcontent-%COMP%]:hover{background:#334155;text-decoration:none}.article-footer[_ngcontent-%COMP%]{margin-top:40px;padding-top:24px;border-top:1px solid #f1f5f9;font-size:.9rem;color:#9ca3af}@media (max-width: 768px){.article-wrapper[_ngcontent-%COMP%]{margin:16px;padding:32px 20px}.article-header[_ngcontent-%COMP%]   h1[_ngcontent-%COMP%]{font-size:1.65rem}.article-content[_ngcontent-%COMP%]   h2[_ngcontent-%COMP%]{font-size:1.3rem}.article-content[_ngcontent-%COMP%]   pre[_ngcontent-%COMP%]{padding:16px;font-size:.82rem}}"]})};export{f as BlogOnlineJsonConverterSafetyPage};