Format first, validate against the contract second
A JSON formatter makes nesting and punctuation easier to read. Valid JSON syntax does not prove that required fields are present, values have the expected types, or business rules are satisfied. Compare the payload with the schema or API contract and test it in the target application.
Use a small representative sample and preserve the original input. If a transformation changes the result, compare the before-and-after versions so you can identify whether the change was formatting-only or altered data.
- Check braces, commas, quotes, arrays, and data types.
- Validate required fields and business rules separately.
- Use test records instead of customer data where possible.
Encode the correct part of a URL
URL encoding represents characters in a URL component; it is not encryption. Usually, encode an individual query parameter value rather than blindly encoding structural characters in the entire URL. After encoding, check that the receiver decodes the value as intended and that separators such as question marks and ampersands still have their proper role.
- Know whether the input is a full URL or a single parameter value.
- Test spaces, plus signs, ampersands, and non-ASCII characters.
- Never place passwords or private tokens in a URL merely because they can be encoded.
Do not confuse decoding with verification
Some token formats can be decoded to show their contents, but decoding does not establish who issued the token, whether its signature is valid, whether it has expired, or whether the current user is authorized. Verification requires the appropriate trusted key, algorithm, issuer and audience checks, and application policy.
A hash is also different from encryption. A digest can help compare exact data against a trusted expected digest, but it does not hide the input by reversible encryption or prove the source is trustworthy by itself.
- Never paste live access tokens, API keys, or passwords into examples.
- Treat decoded content as untrusted input.
- Use approved tooling and procedures for production security investigations.
Keep the debugging process reproducible
Record the sample input, the transformation performed, the expected output, and the environment in which you tested it. Remove secrets from logs and screenshots. If a result differs between local and production environments, compare versions, configuration, encoding assumptions, and the exact bytes sent—not only the displayed text.
- Make one change at a time.
- Document expected versus observed behavior.
- Confirm the final payload in the receiving system.
Example: diagnose a rejected request
Take a small synthetic JSON example and format it so the nesting is easy to inspect. Compare its fields and types with the API contract, then test it in a non-production environment. If a query parameter contains an ampersand or space, encode that component and confirm the receiving endpoint interprets it correctly.
- Keep production credentials out of samples and screenshots.
- Record the exact expected error and observed result.
- Validate the payload in the application that consumes it.
Security checks that formatting cannot perform
A formatter cannot prove that input is safe, that a token signature is valid, or that a user has permission to perform an action. Token verification must follow the application's trusted cryptographic and authorization process. Treat all decoded values as untrusted until validated.
- Do not use decoded claims as proof of authorization by themselves.
- Never treat a UUID or hash as a secret access mechanism.
- Follow your organization's approved handling rules for real data.
Before you finish: checklist
Use this quick review to catch common mistakes before you rely on or share the result.
- Synthetic or sanitized input used
- Original sample retained
- Syntax and schema checked separately
- URL component encoded in the correct context
- Token authenticity and authorization not inferred from decoding
- Output tested in a safe target environment
Frequently asked questions
If JSON formatting succeeds, is the payload valid for my API?
Not necessarily. It may be syntactically valid JSON but still fail required-field, type, schema, or business-rule checks.
Does decoding a JWT prove that it is authentic?
No. Decoding reveals encoded content; authenticity requires appropriate signature verification and claim checks in the trusted application context.
Is URL encoding encryption?
No. It represents characters in a URL component. It does not hide the value or make sensitive information safe to expose.