A hand-edited or copy-pasted IAM policy fails in two very different ways, and conflating them wastes time: either the text is not valid JSON at all — a trailing comma, a missing closing brace, a stray quote — or it is perfectly valid JSON that simply does not have the shape IAM requires, like a policy missing its Version field or a statement with no Effect. IAM Policy JSON Syntax Validator checks both, in the right order, and tells you specifically which kind of problem you have and where.
The first pass is pure JSON syntax. Pasted text runs through the same JSON parser your browser already has, and if that parser rejects it, the tool does not stop at a generic "invalid JSON" message — it reads the character position JavaScript's own parser reports internally, counts the newlines in your text up to that position, and converts it into a line and column number, the same way an editor would point you straight at the mistake. A dangling comma after the last item in a Statement array, a missing quote around a key, an extra closing brace — each produces a specific line and column rather than leaving you to scan the whole document by eye.
Only once the JSON itself parses cleanly does the second pass run: the same structural validator used across every policy tool in this category, checking that the document actually has the shape an IAM policy needs. Version must be present and be a recognized value (2012-10-17, or the legacy 2008-10-17). Statement must be present and must not be an empty array. Each individual statement must carry a recognized Effect of exactly Allow or Deny, must have an Action or a NotAction, and must have a Resource or NotResource — or, for a resource-based policy statement, a Principal in their place. Keeping this as a distinct second pass matters: a document can be syntactically flawless JSON and still be a broken IAM policy, and the tool tells you exactly which of the two problems you are looking at rather than lumping them together as one vague failure.
What this tool deliberately does not do is validate against the full grammar AWS itself enforces when you attach a policy. It has no catalog of valid IAM actions per service, does not check that a Resource value is a well-formed ARN for the service the action belongs to, does not check policy size against AWS's character-count quotas (the separate IAM Policy Size Checker in this category does that), and does not call any AWS API. It answers a narrower, earlier question: is this text valid JSON, and does it have the minimal shape IAM requires before you even attempt to attach it — the two checks that catch the overwhelming majority of hand-editing mistakes before they turn into a confusing "MalformedPolicyDocument" error from the AWS console or CLI.
Once a document passes both checks, a small stat summary shows the total statement count and how many are Allow versus Deny, so you can sanity-check the shape of what you just validated at a glance. The whole check — JSON parsing and structural validation alike — runs locally in your browser; nothing you paste is ever sent anywhere.