JSON Redact
See which values look like an email, an IP address, a phone number, an API key or a name, and watch each one become a fixed placeholder as you type.
Input
Syntax colouring is off for this document because recolouring something this large on every keystroke would slow typing down. Every tool still works normally.
Result
Syntax colouring is off for this document because recolouring something this large on every keystroke would slow typing down. Every tool still works normally.
The redacted document appears here.
Rules
One entry per line in each box. These always redact to [REDACTED], and win over whatever a detector above would have done.
Detections
What this page found appears here.
Runs entirely in your browser. Nothing you paste is uploaded, and you can confirm that in your browser Network tab.
About this tool
Five detectors, each turned on or off on its own, look at every string value in the document. Email and IPv4 are checked against their actual grammar, a local part and a domain for email, four dot separated numbers from 0 to 255 for IPv4, so these two are the closest thing here to a real detector. IPv6 is checked structurally, colon separated groups of hexadecimal digits with :: understood as a run of omitted groups, not against every rule in the full specification, so an address written in a pattern this check does not recognize passes through unflagged. A phone number has no universal grammar at all: this looks for a string built only from digits, spaces, parentheses, a hyphen and a leading plus, with between 7 and 15 digits once the formatting is stripped away, the same loose shape most phone number libraries use as a first pass. An API key or token is recognized by a prefix a real provider actually uses, or by the value's own key name reading as one, token, apiKey, secret, combined with a value that has no spaces and is not trivially short: neither is proof, only a reasonable signal. A name is never guessed from the text of a value at all, since telling a person's name from arbitrary text without a dictionary or a language model is not something this page claims to do honestly; it goes only by the member's own key name, name, firstName, full_name and a handful of others, so a name under an unrelated key is missed and an unrelated value under one of these keys is redacted anyway. Every placeholder is fixed and deterministic: the same kind of match always becomes the same shape of replacement, an email becomes a***@example.com, a phone number becomes ********, everything else becomes [REDACTED], never a value that depends on randomness or on what the original was, so the output stays reproducible. On top of all five detectors, an exact key name or a JSON Pointer typed into the boxes below always redacts to [REDACTED] and wins over whatever a detector would otherwise have done, since a rule someone wrote on purpose outranks a guess. Detection only ever looks at string values: a phone number or an IP address stored as a bare JSON number is not found by a detector, though an explicit key or path rule still reaches it, since that rule replaces a value outright rather than testing its text against a pattern.
How to use
- Paste your JSON into the editor, or load the sample.
- Turn detectors on or off, and add your own key names or JSON Pointers to the rule boxes if the automatic detectors should not be the only thing redacting this document.
- The redacted document and the list of what was found update as you type. Nothing is sent anywhere; the result only ever appears in the pane on the right.