YAML to JSON Converter in Safe Mode, with Anchors and Merge Keys

Convert YAML to JSON in safe mode: anchors, merge keys and multi-document files, exact line errors, unsafe tags rejected. Runs in your browser.

Runs in your browser. Nothing is uploaded.

Converters

YAML to JSON

YAML

Max 50MB each

Files are read in your browser and never uploaded. Up to 50 MB, UTF-8 text.

Safe mode only: tags such as !!js/function or !!python/object are rejected, never run.

Result

Paste YAML on the left, or load the sample. JSON appears here as you type.

Example

Input
defaults: &d
  retries: 3
prod:
  <<: *d
  timeout: 10
  active: yes
Result
{
  "defaults": { "retries": 3 },
  "prod": { "retries": 3, "timeout": 10, "active": "yes" }
}

Converting YAML to JSON

Paste YAML, drop a .yaml or .yml file, or load the sample, and the JSON appears as you type. Block and flow styles, quoted and plain scalars, literal and folded block text, anchors and aliases, and merge keys are all handled. Merge keys (<<: *base) copy a base mapping into another one, a pattern common in Docker Compose and CI files; you can switch their expansion off to see the raw structure. A file with several documents separated by --- becomes an array of documents, or you can take only the first.

The tool follows the YAML 1.2 core rules by default, so yes, no, on and off stay as text and a date such as 2001-01-01 stays a string, which is what most modern parsers do. If your file was written for a YAML 1.1 tool, tick the 1.1 option to read yes and no as booleans, 0777 as octal, and to support timestamps, !!set and !!binary, which are converted to ISO text, arrays and base64 text.

Safe mode only

Some YAML libraries can construct arbitrary objects from tags such as !!js/function or !!python/object/apply, which has led to real remote code execution bugs when untrusted YAML was loaded. This converter only ever uses a plain-data schema. A document containing one of those tags is rejected with an "unknown tag" error and the exact line, never executed or constructed.

Aliases are limited as well. A "billion laughs" YAML file is a few hundred bytes of anchors that reference each other, which is harmless to read but expands to gigabytes when written as JSON. The converter measures the expanded size before writing anything and refuses documents that blow up, and it also refuses circular aliases because JSON cannot represent them. If you do not need aliases at all, turn off "Allow anchors and aliases" to reject any file that uses them.

Errors, numbers and limits

Syntax errors report the line and column together with a short excerpt and a caret, for example a tab used for indentation, a duplicated mapping key, an unclosed bracket or an unknown alias. Integers beyond 2^53 are written to JSON with every digit rather than rounded, and the special floats .inf and .nan, which JSON cannot hold, become null with a warning.

JSON has no comments, so YAML comments are dropped, and key order follows the file unless you ask for sorting. Non-string keys such as numbers become strings. Very large files are converted in a background worker, and nothing leaves your browser. For configuration that matters, validate the JSON against your schema afterwards: valid YAML can still have the wrong shape.

Frequently asked questions

Is it safe to paste untrusted YAML?

The converter only loads plain data. Tags like !!js/function or !!python/object are rejected, and alias expansion is size-limited, so a hostile file cannot run code or exhaust memory. Still, avoid pasting real secrets into any website.

Why is "yes" a string in the output?

YAML 1.2 treats only true and false as booleans. Tick "YAML 1.1 rules" if your file was written for a parser that reads yes and no as booleans.

How are multiple documents handled?

A file with --- separators becomes a JSON array with one item per document. Choose "First document only" to convert just the first.

What are merge keys?

The <<: *name syntax copies the keys of an anchored mapping into another mapping. The converter expands them, and you can switch that off.

Where do the line numbers in errors come from?

They come from the YAML parser position of the first problem, shown with a short excerpt and a caret under the column.

Related tools