A JSON sample you can review before sharing

Hide the values you choose. Keep the rest as written.

Select exact scalar paths in a JSON configuration or API sample. Preview a separate masked copy without reformatting unselected source text or converting its numbers.

Open JSON Mask See two worked examples

Free to use · No account · One UTF-8 file or pasted JSON · Input up to 1 MiB

The processing workspace opens in another tab. This public page does not receive your JSON, selected paths or results.

You know which fields need masking

Choose, preview, then take the new copy.

Open your sample locally. Paste JSON or choose one UTF-8 file, then analyze it. The original stays available in the workspace.
Select actual values by path. A repeated field name does not select every occurrence. Containers are structure; only scalar values can be chosen.
Review the replacements. Choose the marker, preview the whole result and inspect the changed paths. Selecting a number, boolean or null replaces it with a JSON string.
Copy or download deliberately. No result is sent to another person, a server or a share link. Review remaining fields before you share the downloaded JSON yourself.

Fictional data, explicit expected results

A small change should stay a small change.

1. Mask email and token; preserve number spelling.

Choose /email and /token. The 19-digit ID, exponent, trailing decimal zeroes, field order and surrounding whitespace stay as written.

Original

{
  "recordId": 9007199254740993123,
  "ratio": 1.2300,
  "batch": 1e+03,
  "email": "demo@example.invalid",
  "token": "demo-token-only"
}

Masked copy

{
  "recordId": 9007199254740993123,
  "ratio": 1.2300,
  "batch": 1e+03,
  "email": "[REDACTED]",
  "token": "[REDACTED]"
}

2. The same name can identify different values.

Choose only /users/1/token. The first user's token remains unchanged; a matching property name is not permission to replace it.

Original

{"users":[{"token":"demo-alpha"},{"token":"demo-beta"}]}

Masked copy

{"users":[{"token":"demo-alpha"},{"token":"[REDACTED]"}]}

These are synthetic examples, not real credentials, customers, usage or security evidence.

A precise operation, with limits

What the result does and does not establish.

Source text stays intact outside your choices.

Only selected scalar-token ranges are replaced. Unselected numeric literals, escape spelling, object order, spaces, CRLF and trailing whitespace are retained. The tool does not first convert the whole document into ordinary JavaScript numbers.

The marker is encoded as a JSON string. Masking 123, true or null therefore changes that selected value's type to string; it does not preserve a numeric or boolean type.

You still decide what is private.

There is no automatic secret or PII detection, anonymization guarantee, schema approval or business validation. Unselected values, key names and relationships can still reveal information. Review the complete output before sharing it.

The changed-path list contains paths and original types, not original values. Paths themselves may be sensitive.

Supported JSON and practical budgets

Strict JSON only. Comments, trailing commas, JSON5 and JSONL are refused. Duplicate decoded keys, including a and \u0061, are unsupported and rejected as a whole.
One UTF-8 file or pasted input up to 1 MiB; output up to 2 MiB; at most 32 nesting levels and 10,000 nodes. A single pointer is limited to 2,048 UTF-16 units and all pointers share a 1 MiB conservative UTF-16 budget.
A marker may contain up to 100 Unicode code points. Object and array containers cannot be selected. There is no wildcard or property-name guessing.
A single leading UTF-8 BOM is allowed and preserved. Invalid UTF-8 files and actual lone surrogate characters are refused; an unselected ASCII escape such as \uD800 is not rewritten.
Errors and budget failures produce no partial result. Changing input invalidates the old analysis, selection and output; changing the marker or selection invalidates the old result.

One product, a separate processing boundary

Keep the source. Choose the changes.

The private workspace performs the operation in this browser. It has no advertising, analytics, upload endpoint or saved-document service.

Open JSON Mask