API Data Masking: Hide Sensitive JSON Fields
Mask emails, phone numbers, tokens, passwords and card numbers in JSON payloads before sharing them. Custom fields and paths. Runs in your browser.
Data Masking tool
Masking runs entirely in your browser. Original values are never uploaded, stored or logged.
Built-in rules
- email, emailAddress, e_mail → j***@example.com
- phone, phoneNumber, mobile, mobileNumber, msisdn → *******89
- password, passwd, pwd, secret, clientSecret → [REDACTED]
- token, accessToken, refreshToken, idToken, authorization, apiKey, sessionId → [REDACTED]
- accountNumber, iban, cardNumber, pan, cvv, cvc → **** **** **** 1111
Field names match case-insensitively and ignore _ and - (access_token = accessToken).
Field names apply at any depth; paths start with $. Default: [REDACTED]. Add = strategy to choose: email, keep-last-2, keep-last-4, redact, fixed. Pro preview
Original JSON
Masked preview
Masking reduces the risk of sharing sensitive values but can't guarantee every one is found. It is not a compliance control: always review the output.
About this tool
Mask emails, phone numbers, passwords, tokens and account or card numbers in a JSON payload before you paste it into a ticket, chat or bug report. Common field names are covered automatically; add your own fields or JSON paths.
The masked output keeps your formatting and every other value unchanged. After masking, values in other fields that look like emails, card numbers, JWTs or bearer tokens are flagged by path so you can add them too.
How to use it
- Paste the JSON payload.
- Optionally add custom field names or paths.
- Press Mask and preview, review the result, then copy or download it.
Limitations
- JSON only.
- Masked numbers become strings.
- Pattern warnings are heuristics and can miss values.
Example
{
"customer": {
"email": "[email protected]",
"phone": "123456789"
}
}{
"customer": {
"email": "j***@example.com",
"phone": "*******89"
}
}Common use cases
Support tickets
Share a failing request or response with a vendor without exposing customer data.
Bug reports
Attach realistic payloads to issues while hiding tokens and contact details.
Test data
Turn a production-like sample into a fixture that's safer to commit.