How to Format, Validate, and Convert JSON
JSON is the default interchange format of the web, and it has a property that catches people out constantly: it is designed for machines, not for reading. A response from any API is a single line of nested braces that no human can parse by eye.
Formatting is not cosmetic. It is the difference between finding the field you need in five seconds and scrolling horizontally through 4,000 characters.
Why minified JSON is unreadable
A JSON document is a tree — objects containing keys, values, and other objects. Minified output collapses that tree into one line, removing the only visual cue (indentation) that tells you what is inside what.
A formatter re-expands it with indentation, one key per line, values aligned. Same bytes of meaning, dramatically different readability. Most formatters also colour-code strings, numbers, booleans, and nulls, which lets you spot a type mismatch at a glance.
The JSON formatter does this in the browser: paste or drop a file, and it pretty-prints with validation. Nothing is uploaded, which matters more than it sounds — see the note on secrets below.
The errors that break JSON most often
JSON’s grammar is deliberately strict, and it rejects several things that are legal in JavaScript. These are the ones that cause the most confusion:
Trailing commas. {"a": 1, "b": 2,} is invalid. JavaScript accepts it; JSON does not. This is the single most common cause of “my JSON is broken”.
Single quotes. JSON requires double quotes for both keys and strings. {'a': 1} is invalid.
Comments. JSON has no comment syntax. // and /* */ are both errors. If you need comments, you are looking for JSON5 or JSONC, which are extensions, not JSON.
Unquoted keys. {a: 1} is invalid; it must be {"a": 1}.
undefined, NaN, Infinity. None exist in JSON. The nearest legal values are null and, for the last two, a string or a number. A JavaScript object containing these will serialise to null or throw, depending on the serialiser.
Unescaped control characters. A literal newline inside a string is invalid; it must be \n.
A BOM at the start of the file. Some editors add one. JSON parsers reject it. If a file parses fine in one tool and fails in another, check for a BOM.
Validating
Formatting and validating are the same operation in practice: a formatter has to parse the input to re-indent it, so it fails on exactly the input a validator would reject.
What you want from the failure is the position, not just “invalid JSON”. A formatter that reports the line and column turns a hunt into a fix. A bare error message leaves you bisecting a 4,000-character line by hand.
Moving between JSON and CSV
The two formats serve different masters. JSON represents a nested tree; CSV represents a flat table. Converting between them is routine, and the friction is always the same question: what do you do with the nesting?
JSON → CSV. If your objects are flat ({"name": ..., "email": ...}), the mapping is direct: keys become column headers, each object becomes a row. If they are nested, you must decide whether to flatten (join nested paths into dotted column names), drop the nested data, or serialise it back into a cell as a string. Different tools make different choices — check the output rather than assuming.
CSV → JSON. The reverse is unambiguous: rows become objects, headers become keys. Two things to watch: everything in a CSV is a string, so numbers and booleans need re-typing; and delimiter or quoting issues in the source will shift columns silently.
Both run locally. For a dataset with customer records, that is the difference between analysing your data and distributing it.
JSON in places you did not expect
JWTs are JSON. A JSON Web Token is three base64url-encoded segments separated by dots: a header, a payload, and a signature. The first two decode to ordinary JSON. The JWT decoder shows you the header and payload without needing the signing key.
That last clause is the important part, and the security lesson. The payload is encoded, not encrypted. Anyone holding the token can read it. Never put anything genuinely secret in a JWT payload — it is visible to every client that has the token, and to anyone who intercepts it.
Base64 is also not encryption. The base64 encoder exists to make binary data survive text-only channels. It provides no confidentiality whatsoever, and treating it as obfuscation is a common and costly mistake.
Comparing two JSON documents
diff on two minified JSON files is useless — a single reordered key makes every subsequent line differ. The workflow that actually works:
- Format both documents first, so they are structurally comparable.
- Diff the formatted versions with the text diff tool.
- Remember that JSON object key order is not significant. A diff showing a moved key is not a semantic change.
A privacy note that applies to all of this
API responses contain credentials. Access tokens, session IDs, internal URLs, customer records, and personal data are all routine contents of a JSON payload.
Pasting one into a server-side formatter sends it to a third party. That is the entire category of risk described in are online file converters safe, applied to the one kind of text most likely to carry secrets.
Every tool linked above processes locally. You can verify it the same way: open the network tab, perform the operation, confirm no request carries your data.
Frequently asked questions
Why does my JSON fail to parse? Nine times out of ten it is a trailing comma, a single-quoted string, or a comment. After that, check for a BOM at the start of the file and for unescaped control characters inside strings.
Is JSON the same as JavaScript objects?
No. JSON is a strict subset. Valid JSON is usually valid JavaScript, but plenty of valid JavaScript — comments, trailing commas, unquoted keys, undefined — is not valid JSON.
How do I convert nested JSON to CSV? You have to choose: flatten nested paths into dotted column names, drop the nested values, or serialise them into cells as strings. Whichever the tool does, check the output — silent data loss is the usual failure mode.
Can I put comments in JSON? Not in JSON. JSON5 and JSONC allow comments, and some config formats (notably older TypeScript configs) accept JSONC. Plain JSON parsers will reject them.
Is it safe to paste an API response into an online formatter? Only into one that runs locally. API responses routinely contain tokens and personal data. Verify by watching the network tab, or use a tool that never makes a request.
What is a JWT, and is it encrypted? A JWT is a token of three base64url-encoded parts. It is signed, not encrypted — the payload is readable by anyone holding the token. Never store secrets in one.