Skip to content
parsing.tools

Tidy, check and convert JSON, CSV, tokens and more, right in your browser

Replace the sample in the box below with your own text. The page works out what it is, shows a first result and opens the right tool.

Paste here
Result
waiting for inputRecognised in this tab, no request made

Nothing you paste is uploaded. The server sends connect-src 'self', so your browser blocks this page from contacting any other host. Check it yourself

Index of all 14 tools

Each row is a real input and what the tool gives back for it.

JSONTidy it, check it, compare two versions, and turn it into types or a table.

Convert formatsCSV, YAML and XML both ways with JSON, plus SQL and Markdown tables.

Encode and hashBase64, web-address encoding and file fingerprints.

Inspect and testLook inside a token or an address, and try a search pattern.

What this server tells your browser

These lines are read from the policy the server sends with every page. Check it yourself

connect-src
'self'
script-src
'self'
default-src
'self'

One bench, thirteen tools

Paste text in the box above and the page works out what it is: a JSON Web Token, JSON, XML, a URL or query string, YAML, CSV or Base64. It shows a first result and the tool that goes further. Each tool has its own address, so you can also go straight to the one you need, and the "Send to" menu on a result passes it to the next tool: decode a token, format its payload, generate types from it.

Why "in your browser" is worth checking

Developers paste API responses, tokens and configuration into formatters. In November 2025, researchers at watchTowr reported that two widely used formatting sites had been exposing content users saved there, including credentials, through predictable links (BleepingComputer's report). A claim of privacy on a page is not evidence. A policy your browser enforces is, and you can read ours in the response headers: the Verify privacy page shows how.

What this site does not do

  • It has no accounts and no way to save text on a server.
  • It does not validate against JSON Schema, XSD or DTD.
  • It does not fetch an issuer's keys: you paste the public key or JWKS yourself.
  • Its tools never send your pasted inputs to third-party APIs or remote servers.

Links made with "Copy link" hold up to 12,000 bytes of input in the part of the address after #, which browsers keep to themselves. Whoever receives the link can read it, so do not share links that contain secrets.

Questions

Short answers to what people ask most.

Does Parsing Tools send what I paste to a server?

No. Every tool is JavaScript that runs in your browser tab. The server also sends a Content-Security-Policy with connect-src 'self', which makes the browser refuse any connection from these pages to another host. You can read that header yourself in the Network panel of DevTools; the Verify privacy page walks through it.

Is anything stored?

The current input of most tools is kept in sessionStorage so a reload does not lose it; the browser deletes it when you close the tab. The JWT decoder, the hash generator and the JSON diff keep their input in memory only. There is no account and no "save online" feature.

How does the detection work when I paste on the home page?

The text is checked for the shape of a JWT, JSON, XML, a URL, a query string, YAML, CSV and Base64, in that order, using structural tests rather than a full parse. If it guesses wrong, open the tool you need from the list; the text travels with you.

How large can the input be?

There is no upload, so the limit is the memory of your browser. Inputs above about 200,000 characters are processed in a Web Worker to keep the page responsive, and above 1.5 million characters the output is produced when you press Run instead of on every keystroke.

Why use this bench

What is different here, and the code behind each claim.

The policy is connect-src 'self'
Set in the response headers from src/lib/policy.ts and enforced by your browser: scripts here cannot open a connection to another host.
No "save online"
The Worker serves static files, /api/health and a search-engine key file. There is no endpoint that accepts your text.
RegEx stops after 2 seconds
Patterns run in a Web Worker that is terminated on timeout, so catastrophic backtracking cannot freeze the page.
Tokens and secrets are not stored
The JWT decoder, the hash generator and the JSON diff keep their input in memory only; other tools use sessionStorage, cleared when the tab closes.
Errors come with a position and a fix
JSON, YAML and XML errors give line and column, are underlined in the editor, and explain what to change.
Large inputs do not block typing
From 200,000 characters up, parsing moves to a Web Worker.