Paste JSON to pretty-print it with your choice of indentation, or minify it back down. Invalid JSON gets an error naming the line and column and showing the surrounding text, which is usually enough to spot the trailing comma or unquoted key. Runs locally, so it is safe for JSON you should not upload.
Most often a trailing comma after the last item, single quotes instead of double, unquoted keys, or a stray comment. All four are legal in JavaScript object literals and none are legal in JSON, which is what trips people up.
No. Parsing and formatting happen in your browser with no network request, so you can safely paste API responses or configuration that contains credentials.