The conversion boundary is your browser.
ConvertJSON.io serves application code and static page content. It does not receive the JSON, YAML, tokens, bytes, or files you process with that code.
- 1
Input
Paste text or open a local file. The value enters browser memory.
- 2
Convert
Downloaded JavaScript parses and transforms the value in the page.
- 3
Inspect
Diagnostics, summaries, byte rows, and warnings render from local results.
- 4
Export
Clipboard writes and Blob downloads happen on your device.
There is no conversion API call
The parser and converter modules are included in the application bundle. When you press Convert, the event handler calls those local functions directly. You can disconnect after a page loads and continue using text-based tools already present in the page.
Some browser capabilities—such as clipboard permission, downloads, and local file access—still require an explicit user action. None of them routes conversion content through a ConvertJSON.io server.
No input is placed in a link
The site intentionally has no payload share URL. Inputs do not enter query strings, route segments, or fragments, so browser history, copied addresses, referrer headers, and indexable pages cannot accidentally become a payload transport.
Swap between paired tools uses temporary sessionStorage on the same device and removes the value as soon as the destination reads it.
Measurement is separated from content
Pageview analytics still run, and privacy-safe product events report whether a conversion succeeded, failed, was copied, downloaded, or used a formatting preset. A typed allowlist reduces every event to a tool ID, stable category, optional mode or preset, and coarse size bucket.
No input, output, raw parser message, filename, selected text, or clipboard value is accepted by that event boundary. See every event and property.
Local does not mean risk-free
A browser extension, compromised device, shared screen, clipboard manager, or malicious third-party script can still expose data on your machine. Use redacted samples for secrets and customer data, keep your browser updated, and inspect unfamiliar tools before pasting credentials.
JWT decoding is particularly easy to misunderstand: displaying claims is not signature verification and says nothing about whether a token should be trusted.
Open a focused local workflow.
Watch the Network panel while you validate JSON or inspect bytes.