The 2025 formatter leak — and the architecture that prevents it.

Security firm watchTowr Labs disclosed that JSONFormatter.org and CodeBeautify.org had exposed large volumes of user-submitted data. The exposed surface was a "Recent Links" / save-and-share feature: formatted output could be saved and shared via a URL, and those URLs followed a predictable pattern with no authentication, so the saved content was reachable by anyone who guessed the format.

Among the retrieved data were Active Directory credentials, database and cloud keys (AWS / Azure / GCP), private keys, CI/CD secrets, production JWTs, OAuth tokens, SSH keys, and PII / KYC information — originating from organisations in government, critical infrastructure, finance, aerospace, healthcare and telecoms. Researchers also demonstrated active abuse: credentials they planted were probed by third parties within 48 hours of the supposedly-expired link. The finding was covered by The Hacker News, BleepingComputer, and Help Net Security.

Source: watchTowr Labs disclosure (watchtowr.com), November 2025; reported by The Hacker News, BleepingComputer, and Help Net Security.

To keep this honest: the leak came from a specific server-side "save and share" feature that persisted inputs, not from the act of pasting into the formatter itself. Many online tools do not retain submissions at all, and some sites changed their behaviour after the disclosure. This is not a blanket "all online tools leak" story.

The durable lesson is architectural: if a tool can store your input on a server, your threat model has to assume it might — until you verify otherwise. The only way to guarantee that assumption is false is to never send the data to a server in the first place.

Once your input reaches their server, its safety depends entirely on their access controls, retention policy, and whether their infrastructure is compromised. Years of snippets accumulated with weak controls — and were found from the outside.

↳ no server, no database, nothing to leak

1. Open DevTools — F12 (Windows/Linux) or Cmd+Option+I (macOS).
2. Network tab → press clear (⊘).
3. Run the tool on some sample input.
4. No new request? It is client-side. A POST/GET carrying your input? Your data left the browser.