JSON Redact

About this tool

JSON Redact scans a JSON document and masks the secrets inside it — API keys, tokens, passwords, private keys and emails — so you can paste a config, log line, API response or webhook payload into a bug report, gist or chat without leaking credentials. The JSON structure and key order are preserved; only the detected values change.

It detects secrets two ways, together:

• By key name — any value whose key looks sensitive is redacted. Matching is case-insensitive and ignores separators, so password, passwd, X-API-Key, clientSecret, access_token, DB_PASSWORD, authorization, private_key, session_id, email, ssn, cvv, pin and similar all match.
• By value pattern (when Also scan values for secret patterns is on, the default) — any string value that looks like a secret is redacted even under an innocent key: JWTs (eyJ…), AWS keys (AKIA…), OpenAI keys (sk-…), GitHub tokens (ghp_…/gho_…), Stripe keys (sk_live_…), Google API keys (AIza…), Slack tokens (xox…), PEM PRIVATE KEY blocks, and email addresses.

Worked example

Input:

{ "user": "ada", "api_key": "AKIAIOSFODNN7EXAMPLE", "note": "ok" }

Output (default redacted style):

{
  "user": "ada",
  "api_key": "[REDACTED]",
  "note": "ok"
}

api_key is masked by its key name. user and note are left alone (their values don't look like secrets). Run it in a gizza chat or the CLI and you also get a count and the JSON path of every redacted value — here ["$.api_key"].

Replacement styles

• redacted (default) — insert the placeholder text (default [REDACTED]; set your own in the placeholder field).
• mask — replace the value with ***.
• null — replace the value with JSON null.
• empty — replace the value with "".
• preserve-length — replace a string with * repeated to its original length (handy when a downstream schema validates lengths).

Privacy

Everything runs in your browser via WebAssembly — the document is never uploaded to a server. The same logic is available from the gizza CLI and inside a gizza chat.

Limits & edge cases

• Detection is heuristic (key-name + known secret value shapes); it is not a guarantee that every secret is caught. Review the output before sharing anything high-stakes.
• Key-name matching is deliberately broad — a field named token_type or csrf_token is redacted because its key contains token. Turn a value into a non-secret shape or use narrower field names if that's too aggressive.
• Generic high-entropy strings under innocent keys are not flagged unless they match a known vendor pattern (that keeps false positives low).
• The input must be valid JSON — malformed input returns an error rather than a partial redaction.

FAQ