JSON redactor: mask sensitive data
About JSON Redactor
The JSON Redactor masks chosen values before you paste a payload into a ticket, chat, doc or test fixture. Enter key names such as password and token to match them anywhere. Or enter an exact dot path such as user.email to hide one location only.
Switch Find to Detect secrets to scan a JSON, YAML, TOML or .env file for likely credentials instead. It looks for passwords, tokens, API keys, connection strings and private keys by key name and by value, then masks, removes or fingerprints them.
Redaction runs in your browser. Nothing is uploaded. This tool helps you share data, but it does not classify data for compliance. Review the output before you share it, especially free-text strings and oddly named fields.
How it works
Match a key anywhere
A one-part selector such as secret matches that key at any depth, including objects inside arrays. Matching ignores case, so Secret and secret both match.
Target an exact dot path
A selector with dots matches the full path from the root. Use user.email to redact that field and leave billing.email alone. An asterisk stands for one path segment when several objects share the same layout.
Choose a marker and optional visible suffix
Replace values with [REDACTED], three asterisks or a text null marker. The Keep last option keeps the final four or eight characters of string values. That helps when someone needs a partial identifier for troubleshooting.
Detect secrets in config files
Detect secrets matches common key names for passwords, tokens, API keys, credentials, private keys, connection strings, database URLs and DSNs. It also catches URLs with embedded credentials, JWTs, private key blocks and common token prefixes, whatever the key is called.
Format-aware changes
JSON, YAML and TOML are parsed before any value changes, and .env files use a strict parser. YAML comments stay in place. JSON and TOML are written out again, so their layout is normalized. Auto picks the format from the content.
Mask, remove or fingerprint
Mask writes a fixed marker. Remove deletes the property or variable. SHA-256 writes a fingerprint, so you can match repeated secrets without keeping the original text.
Frequently asked questions
Can I redact the same key at every level?
Yes. Enter a single key such as token and every property with that name is replaced, at any depth.
How do exact paths and wildcards work?
Dot paths start at the document root. For example, users.*.email uses the asterisk for one path segment. You can also write array positions as path segments when a specific index matters.
Does this detect sensitive information automatically?
Only in Detect secrets mode, which looks for credentials by key name and value pattern. Keys and paths mode follows the selectors you enter and makes no guesses. Neither mode finds every kind of personal data, so review the output.
Can I redact a YAML or .env file?
Yes. Use Detect secrets and set Format to YAML, TOML or .env, or leave it on Auto. Passwords, tokens and keys are found and masked without touching other values.
Is keeping the last four characters always safe?
No. It helps you match opaque identifiers, but any kept characters reveal something. Replace the whole value when the suffix is itself sensitive or the value is short.
Is a SHA-256 fingerprint always safe?
Not for short or predictable values, because those hashes can be guessed. Fingerprints help you match values. Use Mask or Remove for public sharing.
Sources & last verified
We checked this tool's behavior and the claims on this page against the specifications below on . The tool runs in your browser, so the output you see is exactly what the engine produced.
- RFC 8259: The JSON Data Interchange Format
- YAML 1.2.2 specification
- TOML v1.0.0 specification
- dotenv: .env file rules
Found a wrong result or an outdated claim? Report an error and we will check it again.
SQL Formatter
CSV Editor
XML Validator / Formatter
YAML Formatter
YAML / Config Merge
JSON Formatter