Redact JSON

by key name · by key pattern · by value pattern · mask, hash, remove

Before a payload goes into a bug report, a support ticket or a public gist, the secrets in it have to go. Name the keys, or match them with a pattern, or hunt values that look like emails and card numbers wherever they hide. The structure survives intact — which is the point, because a redacted payload that no longer reproduces the bug is worthless.

How to redact a JSON document

1. Paste the document. Nesting is walked to any depth, arrays included.
2. List the key names you know about — password, token, ssn. Matching is case-insensitive.
3. Add a key pattern to catch the ones you don't: (?:secret|token|passw|auth|key) covers most of what an unfamiliar payload will hide.
4. Add a value pattern for data that lives in free text — an email address inside a notes field is not caught by any key rule.
5. Read the status bar: it counts the hits and names the keys that matched most. Zero hits means nothing was redacted, which is the failure mode to watch for.

Choosing what to write instead

Mask keeps the length, which preserves the shape of the data — useful when the length itself is diagnostic, dangerous when the value is short enough that length narrows it down. Keep last N leaves a tail visible, the way a payment form shows the last four digits; it is convenient and it is a deliberate partial disclosure.

Placeholder writes one fixed string, discarding length entirely — the safest of the value-preserving options. Hash writes a short stable digest, so equal inputs give equal outputs and you can still tell whether two records shared a value. That correlation is the whole point and also the risk: a hash of a low-entropy value such as an email address is reversible by anyone who can guess candidates, so treat it as pseudonymisation, not anonymisation. Remove deletes the key, which is the only option that leaks nothing at all — and the one most likely to break a consumer that requires it.

What this does not do

It matches names and patterns you supply. It does not understand your data, so a secret stored under an innocuous key with no recognisable shape will pass straight through. Always read the output before sharing it, and prefer an allowlist when you can: Filter array or a schema-driven projection that keeps only the fields you named will never leak a field you did not think of.

Value-pattern matching applies to string values only, and replaces just the matching part of the string, so a sentence keeps its surrounding words. Useful patterns: [\w.+-]+@[\w-]+\.\w+ for email, \b\d{13,19}\b for card-like digit runs, \b\d{1,3}(?:\.\d{1,3}){3}\b for IPv4, (?:sk|pk)-[A-Za-z0-9]{16,} for API keys.

Privacy

Nothing is uploaded. The redaction runs in this tab using your own browser's JavaScript engine — no server sees your data, and the page keeps working with the network disconnected. That matters more here than on any other page of this site: the whole reason you are redacting is that the payload should not leave your machine unredacted.

FAQ

Related JSON tools