Convert YAML to JSON and Back
Convert YAML files to JSON or JSON to YAML instantly — a free tool for developers.
Your file stays on your device
Nothing to delete afterwards
Safe for pipeline and secret files
Works in every modern browser
How it works
- 1
Paste YAML or JSON
A pipeline definition, a Kubernetes manifest, a compose file, a locale file or an API payload.
- 2
Read the warnings
Retyped values, lost comments and duplicate keys are listed before you take the output anywhere.
- 3
Copy the result
Take it into a repository, a request body, a configuration file or a test fixture.
Why use this tool
Guessed types are flagged
Any unquoted value YAML would read as a boolean, a number or a date is shown to you before conversion.
The Norway problem is caught
A bare NO is a country code far more often than it is the word false, and you are told which one you got.
Leading zeros survive
Phone numbers, postal codes and identifiers keep the zero that an octal interpretation would eat.
Comment loss is reported
JSON has no comments, so you are told how many will disappear rather than discovering it in review.
Anchors and aliases explained
Shared nodes are expanded on the way to JSON, and the expansion is shown so nothing changes behind your back.
Nothing leaves the browser
Pipeline files, manifests and playbooks are converted on this page and uploaded nowhere.
YAML guesses what your values mean, and the guesses have famous casualties
JSON asks you to say what a value is: quotes make a string, bare digits make a number, and nothing is ambiguous. YAML infers instead, and the inference is the single largest source of surprise in the format. The best-known case has a name — the Norway problem. Write a list of country codes and the entry `NO` does not arrive as the string Norway expects; under YAML 1.1 rules it arrives as the boolean false, because the specification lists `y`, `yes`, `n`, `no`, `on`, `off`, `true` and `false` in every capitalisation as boolean literals. The same rule turns Ontario’s `ON` into true, turns a column of `Y` and `N` answers into booleans, and turns a chemistry dataset’s `NO` into a false. It gets worse because parsers disagree: YAML 1.2 narrowed the list to `true` and `false` only, but a great deal of software still implements 1.1 or something in between, so the same file means different things in Python, Go and Ruby. The fix is one character of quoting, and the hard part is knowing where you need it. That is what the warnings here are for.
Numbers that are not the numbers you wrote
The second family of surprises is quieter than the first because it produces a value rather than an error. A leading zero has meaning in YAML 1.1: `0755` is octal and evaluates to 493, which is fine when you meant file permissions and wrong in every other case. A phone number written as `0912345678` therefore stops being that string, and an identifier beginning `08` or `09` is not even valid octal, so parsers split between raising an error and falling back to a string — the same file loading cleanly on one machine and failing on another. Version numbers suffer differently: `1.10` is a float, and a float does not keep trailing zeros, so it comes back as 1.1 and your dependency pin now points at the wrong release. YAML 1.1 also understood sexagesimal, which is why `12:30:00` could arrive as 45000 and a MAC address could turn into a very large integer. And a date-looking scalar such as `2026-07-31` is parsed into a date object rather than a string, which is why a version field or an invoice reference sometimes arrives as a timestamp in one language and a string in another.
Indentation is the syntax, and a tab character is never allowed
YAML uses indentation for structure the way Python does, but with a rule Python does not have: tab characters are forbidden as indentation, absolutely and everywhere. That is one of the few places the specification is strict, and it produces one of the least helpful error messages in common tooling, because the offending character is invisible. A block pasted from an editor configured for tabs, or copied out of a terminal, or lifted from a documentation page, will fail to parse for a reason nothing on screen explains. There is a second consequence that matters more in practice: because indentation carries meaning, you cannot safely paste a block from one file into another at a different nesting depth, and you cannot concatenate two YAML files the way you can concatenate two lists. A single space of drift moves a key from one parent to another, and the result is usually still valid YAML — a document that parses cleanly and describes something you did not intend. That failure mode is the reason converting to JSON to inspect the structure is a genuinely useful habit.
Converting to JSON loses things, and comments are the one you will miss
YAML is often described as a superset of JSON, and for data that is nearly true — but only for data. The features YAML adds do not survive the round trip. Comments are the obvious loss and the painful one: a Kubernetes manifest, a CI pipeline or an Ansible playbook is typically half explanation, and a trip through JSON deletes every line of it silently, which is how a reviewer ends up looking at a configuration whose reasoning has evaporated. Anchors and aliases are the second loss. YAML lets you define a node once with `&defaults` and reference it with `*defaults`, and merge it into other mappings with the merge key; JSON has no such concept, so the conversion must expand every reference into a copy. The document still means the same thing, but the shared definition is gone and a future edit that was meant to change five places now changes one. YAML also allows several documents in one stream, and keys that are not strings — neither has a JSON equivalent. This tool reports each of these rather than performing them quietly.
A YAML parser can be asked to build objects, and that is a code execution bug
This is the security property that separates YAML from JSON, and it is worth stating plainly because the defaults have historically been wrong. YAML supports tags that tell the parser what type to construct, and several language bindings implemented that literally: a document containing `!!python/object/apply:os.system` instructs a naive loader to call that function with the arguments you supply. In PyYAML, the function named `load` did exactly this for years while `safe_load` did not, which meant that reading a configuration file with the obvious-looking function was remote code execution if an attacker could influence the file. The same class of bug has appeared in Ruby, in Java through SnakeYAML, and in .NET deserialisers. The lesson generalises past YAML: any format that can describe which class to instantiate is a code format, not a data format, and untrusted input must go through a loader restricted to plain scalars, sequences and mappings. This tool constructs nothing at all — it parses to plain data and stops there.
YAML is where the credentials live, which is the argument for converting locally
Look at what is actually written in YAML and the case for keeping it on your machine makes itself. It is the format of infrastructure: continuous integration pipelines, Kubernetes manifests and secrets, Helm values, docker-compose files, Ansible playbooks and inventories, Terraform variable files, service definitions. A CI configuration is, in most repositories, the single most credential-dense file present — it names the registry, the deployment target, the environments, and it usually references the tokens by the exact variable names that unlock them. A Kubernetes Secret is base64 rather than encrypted, which means it is plaintext with an extra step. And people reach for a converter precisely when one of these files has failed and needs inspecting, so the example on the clipboard is the real one, not a redacted sample. Everything on this page runs in JavaScript in your browser and issues no request; open the network panel of your developer tools before you paste and you will watch the count stay still.
Common mistakes to avoid
- Leaving a country code or an abbreviation unquoted. Under YAML 1.1 rules `NO`, `ON`, `Y` and `N` are boolean literals, so Norway becomes false and Ontario becomes true.
- Writing an identifier with a leading zero. `0755` is octal, a phone number stops being that string, and something starting `08` is not valid octal at all — so parsers disagree about what to do.
- Pinning a version as a bare number. `1.10` is a float and floats do not keep trailing zeros, so the value comes back as 1.1 and points at a different release.
- Indenting with a tab character. Tabs are forbidden as indentation everywhere in YAML, and the error message will not tell you that because the character is invisible.
- Loading untrusted YAML with a permissive loader. Tags can name a class to construct, which is how reading a configuration file became remote code execution in PyYAML and SnakeYAML.
How it compares
| Aspect | This tool | Online converters | A command-line tool |
|---|---|---|---|
| File sent to a server | Never | Usually yes | No |
| Warns about guessed types | Yes | No | Rarely |
| Reports comments that will be lost | Yes | No | No |
| Detects duplicate keys | Yes | Rarely | Varies |
| Constructs objects from tags | Never | Varies | Depends on the loader |
| Price | Free | Free / paid tiers | Free |
Features
Both directions
YAML to JSON and JSON to YAML, with the indentation and quoting style under your control.
Type-coercion warnings
Every implicitly typed scalar is listed with the value YAML read and the value you probably meant.
Duplicate key detection
A repeated key silently overwrites in most parsers, so it is reported instead of quietly applied.
Multi-document streams
Documents separated by three dashes are handled and mapped to a JSON array rather than dropped.
Anchor and alias expansion
Shared and merged nodes are resolved with their expansion visible, including merge keys.
Large files supported
A long manifest or a full translation file converts without an upload or a size ceiling.
Nothing to install
No build tool, no runtime, no dependencies — it runs in the web page.
Arabic and RTL ready
The full interface in eight languages, including right-to-left Arabic.
Secure by default
Served over HTTPS, with no content tracking and no third-party upload.
Who uses it
Platform and DevOps engineers
Checking what a manifest actually says once the anchors are expanded.
Backend developers
Turning a JSON payload into a readable configuration file, or the reverse.
Localisation teams
Moving translation files between a YAML-based framework and a JSON-based one.
Anyone debugging a pipeline
Finding the unquoted value that a parser read as a boolean.
Frequently Asked Questions
No. Everything runs locally in your browser — your text is never uploaded, stored, or shared.
Yes — completely free, with no account and no limits.