JSON Workbench

What is JSON Workbench?

JSON Workbench is the everything-JSON tool for bug-bounty and pentest workflows. The basics - beautify, minify, validate with line/column error pointers - plus a comprehensive set of operations that pay for themselves the first time an API response is more than five lines deep.

Five workspaces in one tool: Format & Convert (with one-click output to YAML / XML / CSV / PHP array / JavaScript object / JSONL / form-urlencoded), JSONPath query (extract emails, tokens, user IDs from any depth without scrolling), Diff (compare two API responses side by side with line-level add/remove highlighting), Extract secrets (regex-scan every string value for URLs / emails / IPs / JWTs / AWS keys / Stripe keys / Slack tokens / private keys with the JSONPath of every hit), Stats (depth, key counts, type distribution, deepest path, longest string).

Everything client-side. Nothing about your JSON ever leaves the browser - works for sensitive captures, tokens, raw API responses with PII.

What it does

Format - beautify with configurable indent (2 / 4 / tab), minify to single-line, validate with line + column error pointer.
Sort keys - recursively alphabetise object keys for canonical diffing.
Unescape stringified JSON - one click to strip an outer layer of JSON-encoding (very common in tokens / nested API responses).
Convert to YAML - nesting-aware, quoting strings that look numeric.
Convert to XML - nested object → nested tags, arrays as repeated elements.
Convert to CSV - flattens nested objects with dot-notation column headers (addr.city). Requires an array at the root.
Convert to PHP array - ['key' => 'value'] syntax, valid PHP literal.
Convert to JavaScript object - bare keys when safe, quoted otherwise.
Convert to JSONL - newline-delimited JSON, the format every log pipeline expects.
Convert to query string - nested objects flattened with bracket-indexing (roles[0]=admin). Pair with the Request Converter for Content-Type switching tests.
JSONPath query - $ root, .key, ['key'], [N], [*], ..key recursive descent. Optional "+ paths" mode shows the full JSONPath of every match.
Two-pane Diff - both sides beautified (and optionally sorted) so cosmetic differences are ignored. Line-level LCS highlights additions / removals.
Secret extraction - scans every string value for URLs, emails, IPv4, JWTs, AWS access keys, GitHub PATs, Slack tokens, Stripe keys, OpenAI keys, Google API keys, MongoDB URIs, Slack/Discord webhooks, bearer tokens, private keys, base64/hex blobs - each shown with the JSONPath it was found at and a severity badge.
Stats - root type, total bytes, total keys, max depth, object/array/string/number/boolean/null counts, longest string value, deepest path.
Local-only - no server calls. Sensitive JSON stays in your tab.

Where it fits in your workflow

→Drop a captured API response from Burp / DevTools → Beautify → spot a leaked PII field or stack trace at a glance.
→Run Extract on a JSON response - instantly see if it contains AWS keys, JWTs, internal URLs, IPv4 internal IPs, MongoDB connection strings.
→Paste two captures from before/after a state change → Diff → see exactly which fields the server modifies (catch IDOR / privilege escalation).
→Extract all $..token values from a deeply nested API config dump to test which are actually used.
→Convert a JSON config to PHP / JS for inclusion in a PoC report (pocgen link in pivots).
→Convert an array of records to CSV for an Excel-friendly deliverable, or to JSONL to feed into jq.

Want more?

This one is free in your browser. Sign up for server-side recon, scan history, and projects.

Create free account Sign in

At a glance

CategoryEncoders & Converters

RunsIn your browser

Token cost Free - no tokens

Access No login needed

Status● Live

Frequently asked questions

How does the JSONPath subset compare to JMESPath / jq?

It implements the most common JSONPath operations: root $, property .key / ['key'], index [N], wildcard [*], and recursive descent ..key. Filter expressions like [?(@.x=='y')] are not supported - for that, use jq on the CLI or paste into jsonpath.com.

What is "Unescape" for?

Many APIs return a JSON-encoded string that itself contains JSON: "{\"name\":\"alice\"}". Unescape removes one layer of stringification so you can read / process the inner JSON. Common when an API wraps its real response in a string field for legacy compatibility.

How does the secret extractor compare to KeyHacks Scan?

Both use regex patterns to find known key formats. KeyHacks Scan works on arbitrary text and links each finding to a validation curl command. JSON Workbench’s Extract is tuned for JSON: it walks the structure recursively, reports the JSONPath of each hit, and is faster to navigate when the input is a nested API response.

Is anything sent to the server?

No. The tool is a static page that runs entirely in your browser. Beautify, convert, query, diff, extract, stats - all client-side.