Censor JSON

JSON is a convenient envelope for personal data — and a convenient leak. User records, order exports, support payloads and API responses routinely contain fields like password, ssn, email or card_number that should never leave your machine. Editing them out by hand is slow, error-prone and easy to miss in deep nesting. A deterministic tool is safer.

Censor JSON removes or masks every field you name, at every level of the document, in one click. Drop in a comma-separated list of keys, choose remove or mask, and the report tells you exactly how many occurrences were handled. Processing is 100% client-side — the data never leaves your browser.

• Remove or mask: Delete matching fields entirely, or replace their values with a placeholder of your choice.
• Deep walker: Catches matching keys inside nested objects, arrays and arrays of arrays.
• Case-insensitive by default: password matches Password, PASSWORD and every casing in between.
• Custom placeholder: [REDACTED], ***, or any text that fits your convention.
• Occurrence report: See how many fields matched and which key names were hit.
• Live preview: Results update as you type the key list.
• Copy and download: Export the cleaned document instantly.
• Private: All processing happens in your browser; nothing is uploaded.

1. Paste your JSON into the input pane.
2. List the keys to censor, separated by commas — for example password, ssn, email.
3. Choose remove to delete the fields or mask to replace their values with a placeholder.
4. Adjust matching — case-insensitivity and placeholder text — if needed.
5. Censor and copy or download the cleaned document.

Example 1 — Support payload. A support engineer pastes a user record containing password and api_key into a ticket. Censoring those two keys produces a payload that is still realistic and complete for the engineer, without secrets in the thread.

Example 2 — Dataset export. A team exports customer rows for a demo environment. Masking email and phone with [REDACTED] keeps the data shape and value types predictable while removing personal identifiers.

Example 3 — API sample. A developer sanitizes a response before putting it in public documentation. Removing auth_token and session_id leaves a clean example schema.

Example 4 — Audit review. A compliance reviewer checks a large export for a set of regulated field names. The occurrence report shows exactly where each sensitive key appeared, so the review is provably complete.

• Provable coverage: The occurrence report shows every matched field, not a best-effort search.
• Two strategies: Remove fields for privacy, mask them when structure must stay intact.
• Time savings: A comma-separated list replaces minutes of manual scrubbing.
• Zero data movement: The document is processed locally and never uploaded.
• Consistent results: The same list produces the same output every time.