JSON Formatter

Format, minify, and validate JSON instantly in your browser

Status

—

Keys

—

Depth

—

Size

—

Working with JSON

JSON in authentication, APIs, and configuration

JWT Payloads

JWTs carry JSON claims — user identity, roles, scopes, and expiry. Formatting the decoded payload makes it easy to audit what's being asserted.

OIDC Discovery

OpenID Connect discovery documents are JSON objects. Formatting them reveals supported scopes, grant types, endpoints, and signing algorithms at a glance.

API Responses

Token introspection, userinfo endpoints, and error responses all return JSON. Use minify to compact payloads before storage or formatting to inspect them.

Working with JSON in auth workflows

Where it shows up

JWT payloads and headers are JSON once decoded. OIDC discovery documents, JWKS key sets, and userinfo responses are JSON. So is most of a Management API. Formatting and validating it is a routine part of debugging an integration.

JWKS documents in particular are worth reading closely — a keys array with more than one entry means rotation is in progress or a previous rotation didn't finish, and that's exactly the state where kid matching starts to matter.

Validation catches real bugs

Trailing commas, single quotes instead of double, and unquoted keys are all valid JavaScript object literals and invalid JSON. They're a frequent source of config files that load in one tool and fail in another.

Duplicate keys are technically permitted by the spec but handled inconsistently — most parsers keep the last occurrence, some the first. In a claims object that ambiguity is a security problem, not just a correctness one.

Formatting is not sanitizing

Pretty-printing does not make untrusted JSON safe. If you render parsed values into a page, you still need output encoding; if you use them in a query, you still need parameterization.

Worth keeping in mind when pasting a token payload somewhere: the values came from a token, and until that token's signature is verified, every field in it is attacker-controlled input.

Frequently asked questions

No. Parsing, validation, and formatting all run in your browser. This matters because API responses and token payloads routinely contain personal data.

Most often a trailing comma after the last element, single quotes instead of double, or unquoted keys. All three are legal in JavaScript and illegal in JSON, which is why they slip through.

The spec permits them but leaves the behaviour undefined, and parsers disagree — most take the last occurrence, some the first. Avoid them entirely, especially in anything security-relevant like a claims object.

Not in standard JSON. JSON5 and JSONC add them, and some tools accept them in config files, but a strict parser will reject them. Strip comments before feeding JSON to anything standards-compliant.

JSON numbers are IEEE 754 doubles in most parsers, so integers beyond 2^53 lose precision silently. Represent large IDs as strings. This bites with Twitter-style snowflake IDs and with timestamps in nanoseconds.

Next steps

Related tools

In the docs

All developer tools

Working with our API responses?

The Management API returns JSON for every user, tenant, role, and connection — scriptable, documented, and available on the free tier.

Start free Browse the Management API

Free, unlimited users. No credit card required.