Scan any JSON for XSS payloads, SQL injection, hardcoded secrets, API keys, and PII. Free, private, runs entirely in your browser.
Open Security Scanner →JSON data flows through every layer of modern web applications — APIs, databases, logs, and front-end state. Each layer is a potential attack surface. The JSON Security Scanner automatically checks your data for the following threat categories:
| Threat | What It Finds | Risk Level |
|---|---|---|
| XSS Payloads | <script> tags, javascript: URLs, event handlers | Critical |
| SQL Injection | UNION SELECT, DROP TABLE, --comments, OR 1=1 | Critical |
| Hardcoded Secrets | API keys, tokens, passwords in JSON values | High |
| PII Data | Emails, phone numbers, credit cards, SSNs | High |
| Prototype Pollution | __proto__, constructor, prototype keys | High |
When user-submitted content is stored as JSON and later rendered in a browser without sanitization, XSS attacks become possible. A value like "name": "<script>alert(1)</script>" in an API response can execute arbitrary JavaScript if injected into the DOM directly.
REST APIs often accept JSON bodies that are used to build SQL queries. A value like "search": "' OR 1=1 --" passed to an unsanitized query can expose or destroy entire databases.
Configuration files and environment exports often contain secrets: "api_key": "sk-abc123...". Accidentally committing or logging these values is one of the most common causes of security breaches.
JSON keys like __proto__ or constructor can pollute JavaScript object prototypes when parsed with vulnerable libraries, potentially changing application behavior globally.
Yes. JSON Web Tools processes everything in your browser. Your data is never sent to any server. You can disconnect from the internet after the page loads and the scanner will continue to work.
No. This scanner is a quick first-pass tool for common patterns. It is useful for catching obvious issues during development and code review. A full security audit involves penetration testing, dynamic analysis, and review of your entire stack.
Mask or remove the PII before storing or transmitting the JSON. Use our built-in JSON Masking tool to automatically redact sensitive fields. For production systems, implement server-side data minimization and access controls.
Yes, the scanner handles large JSON objects. Since all processing is in-browser, performance depends on your device. Files up to several MB scan in under a second on modern hardware.
Free, instant, 100% private. No account needed.
Open Security Scanner →Also useful: JWT Decoder | JSON Formatter | JSON Validator | JSON Schema Validator | Security Guides