Validate JSON, XML, HTML, CSS, and JWTs
A validator (JSON lint, XML well-formed check, HTML nest check, CSS braces, JWT decode) answers yes or no with a because. A pass means the parser accepted the text — not that your OpenAPI schema matches, and not that a JWT signature is valid.
Why people validate JSON (and what JSON lint means)
JSON validate and JSON lint are the same job for most searches: can `JSON.parse` / `json_decode` eat this? `{"ok":true}` passes. `{ok:true,}` fails — unquoted keys and a trailing comma. Comments belong to JSONC (VS Code settings), not JSON. Smart quotes from a docs site are another classic fail.
XML well-formed means tags nest and names match. Valid against an XSD is a schema story. A JWT decoder Base64URL-decodes the payload so you can read claims like `{"sub":"dev"}`. Anyone can read that postcard. Checking the signature belongs on a server with the key.
How to use a validator without fooling yourself
Paste the body. Run. If it fails, fix the reason, do not “helpfully” guess commas. If it passes, pretty-print so a human can review. HTML nest checks are not the W3C Nu HTML5 checker. CSS brace matching will not tell you unused `.hero` rules. Green is sanity, not a security audit.
Tools in this hub
JSON Validator
Validate JSON online. Parse errors with a clear message. Works as a JSON linter for API payloads.
JSON Lint
JSON lint online. Check syntax, then pretty-print if it parses. Built for pasted responses and config files.
XML Validator
Validate XML online. Well-formedness check for tags, nesting, and declarations.
HTML Validator
Validate HTML structure online. Catch unclosed tags and obvious nesting issues in snippets (not a full W3C clone).
CSS Validator
Validate CSS online. Brace matching and basic syntax checks for stylesheets pasted from the wild.
JWT Decoder
Decode JWT header and payload online. Base64URL parse only — it does not verify signatures. Inspect claims safely in the browser.
Questions about validators
What does a JSON validator actually check?
That the text is legal JSON — braces, quotes, commas, types. {"ok":true} passes. {ok:true,} fails: unquoted keys and a trailing comma are JavaScript. A pass is not an OpenAPI schema match. It is “the parser did not spit.”
Is JSON lint different from JSON validate?
Same job, different search phrase. Both ask: can this parse? On success you often get a pretty copy so you can look. On failure you want a because, not a shrug.
What is a classic JSON fail?
{"flag": true // beta} — comments are JSONC, not JSON. Smart quotes from a docs site are another classic. Fun fact: JSON will not accept NaN even though JavaScript will.
Does HTML validate here mean W3C HTML5?
Nesting and closed tags are the practical check. Full spec theater is a different parser. <p>Hi<div>there</div></p> is where browsers and “what you typed” diverge. Read the error; do not assume a green check is a compliance stamp.
XML valid versus well-formed?
Well-formed means tags nest and names match. Valid against an XSD is a schema story. <Item> and <item> are different tags in XML. HTML is sloppy about that. Beautify will not merge them for you.
What does a JWT decoder prove?
That you can read the postcard. The middle part is Base64URL JSON: {"sub":"dev"}. Anyone can read it. The signature is the lock. Decoding claims is not verifying a signature.
Can CSS validate unused rules?
Brace matching will not tell you that .hero is dead because your template never prints it. Unused CSS needs your HTML. A validator here is sanity, not coverage.
What does a green pass mean?
The checker you opened is satisfied. It is not a security audit, not a schema, not a performance score. Next step: format so humans can review, then go live with minify plus gzip if the file is the public copy.