JSON Masking and Redaction

About This Tool

Mask sensitive fields in JSON before sharing, logging, or debugging. This tool runs entirely in your browser — no data is ever sent to a server. Free to use, no account required.

What JSON Data Masking Is

Masking replaces sensitive field values with a placeholder before the JSON is shared, ensuring private data does not leave a controlled environment.

Key-Based Masking

Specify keys like "password", "token", or "ssn" and all values under those keys — at any nesting depth — are replaced with *** or a custom mask string. This is the fastest way to sanitize common sensitive fields.

Pattern-Based Masking

Use regex patterns to mask values that look sensitive regardless of key name — all email addresses, all credit card numbers, all Bearer tokens. This catches sensitive data stored under unexpected key names.

When to Use JSON Masking

Masking is important whenever JSON containing sensitive information needs to be shared outside a secure context.

Sharing Logs and Debugging Info

Mask sensitive fields before pasting JSON into Slack messages, Jira tickets, GitHub issues, or support requests. This prevents accidental exposure of API keys, passwords, or personal data.

Preparing Test Data

Create realistic but safe test fixtures by masking production data. The masked JSON retains the structure and non-sensitive values, making it useful for testing without exposing real user data.

JSON Data Masking Reference

JSON masking protects sensitive data (PII, credentials, financial data) in logs, API responses, and debugging outputs. It's required for GDPR, PCI-DSS, and HIPAA compliance.

Masking Strategies

// Original
{
  "name": "Alice Johnson",
  "email": "alice@example.com",
  "phone": "+1-555-0134",
  "ssn": "123-45-6789",
  "creditCard": "4111111111111111",
  "password": "secret123"
}

// Masked
{
  "name": "A*** J***",
  "email": "a***@e***.com",
  "phone": "+1-***-**34",
  "ssn": "***-**-6789",
  "creditCard": "****-****-****-1111",
  "password": "***"
}

Masking Patterns by Data Type

JavaScript Masking Implementation

const SENSITIVE_KEYS = new Set(["password","token","apiKey","ssn","creditCard"]);

function maskJson(obj) {
  if (typeof obj !== "object" || obj === null) return obj;
  return Object.fromEntries(
    Object.entries(obj).map(([k, v]) => [
      k,
      SENSITIVE_KEYS.has(k.toLowerCase()) ? "***" : maskJson(v)
    ])
  );
}

JSON Masking: Protecting Sensitive Data

Masking replaces sensitive field values with redacted placeholders so the data can be safely shared in logs, bug reports, or debugging sessions without exposing private information.

// Before masking
{
  "user": {
    "id": 12345,
    "name": "Alice Smith",
    "email": "alice@example.com",
    "password": "mySecretP@ss!",
    "creditCard": "4111-1111-1111-1111",
    "apiKey": "sk-abc123xyz789",
    "address": {
      "street": "123 Main St",
      "city": "London"
    }
  }
}

// After masking sensitive fields
{
  "user": {
    "id": 12345,
    "name": "Alice Smith",
    "email": "al***@***.com",
    "password": "****",
    "creditCard": "****-****-****-1111",
    "apiKey": "sk-****",
    "address": {
      "street": "123 Main St",
      "city": "London"
    }
  }
}

Fields That Should Always Be Masked

These field types require masking under GDPR, PCI-DSS, and HIPAA regulations. When in doubt, mask any field that could identify or harm a person if exposed.