Javascript is required
Tiny's Tool
中文EN

API Log & JSON Redactor

Mask matching values, then review what remains. Use synthetic or approved input.

An empty expression uses the default pattern shown below. Matching is by substring unless you add anchors. password|secret|token|api_key|credit_card|auth|ssn

Matching can miss secrets or mask harmless data. Review the entire output, including JSON key names, before sharing.

Masked text to review
-- Enter input to inspect matching

Four masking cases and their limits

Loading replaces both input and key expression. Expected text and counts can be read before JavaScript runs.

Decoded email, nested keys and token-shaped text

The Unicode-escaped email separator is decoded before email matching. A matched auth object counts once; descendants are not scanned. The two IPs, Bearer text, JWT shape and password bring the total to seven operations.

Key expression (case-insensitive): password|secret|token|api_key|credit_card|auth|ssn · Replacement operations: 7

Input log or JSON

{
  "request": {
    "email": "ada\u0040example.com",
    "ip": "192.0.2.7",
    "ipv6": "2001:db8::1",
    "auth": {
      "token": "DEMO_ONLY",
      "note": "not exported"
    }
  },
  "events": [
    {
      "message": "Bearer demo-token"
    },
    {
      "value": "eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.c2ln"
    }
  ],
  "password": "DEMO_ONLY",
  "ok": true
}

Expected output

{
  "request": {
    "email": "[REDACTED_EMAIL]",
    "ip": "[REDACTED_IP]",
    "ipv6": "[REDACTED_IP]",
    "auth": "[REDACTED]"
  },
  "events": [
    {
      "message": "Bearer [REDACTED_TOKEN]"
    },
    {
      "value": "[REDACTED_JWT]"
    }
  ],
  "password": "[REDACTED]",
  "ok": true
}

The JWT is synthetic and no signature is verified. A parent replacement does not count every hidden secret.

Plain logs: matches, false positives and omissions

Six operations mask an email, three IP-shaped values, Bearer text and a JWT shape. The version number is also masked; time, an opaque token, local-only email and invalid IP remain visible.

Key expression (case-insensitive): password|secret|token|api_key|credit_card|auth|ssn · Replacement operations: 6

Input log or JSON

email=ada@example.com
ipv4=192.0.2.7
ipv6=2001:db8::1
auth=Bearer demo-token
jwt=eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.c2ln
version=1.2.3.4
time=12:30:45
opaque=demo-session-token
local_email=name@localhost
bad_ip=999.1.1.1

Expected output

email=[REDACTED_EMAIL]
ipv4=[REDACTED_IP]
ipv6=[REDACTED_IP]
auth=Bearer [REDACTED_TOKEN]
jwt=[REDACTED_JWT]
version=[REDACTED_IP]
time=12:30:45
opaque=demo-session-token
local_email=name@localhost
bad_ip=999.1.1.1

Text matching does not understand log semantics. A valid-looking address can be harmless and a missed opaque token can be sensitive.

Exact key matching without losing property names

The anchored expression matches only secret. author, __proto__, constructor and both email-named keys are retained; the sensitive property value is replaced once.

Key expression (case-insensitive): ^secret$ · Replacement operations: 1

Input log or JSON

{
  "author": "Ada",
  "__proto__": {
    "note": "keep"
  },
  "constructor": "own",
  "a@example.com": 1,
  "b@example.com": 2,
  "public_note": "DEMO_PUBLIC",
  "secret": "DEMO_SECRET"
}

Expected output

{
  "author": "Ada",
  "__proto__": {
    "note": "keep"
  },
  "constructor": "own",
  "a@example.com": 1,
  "b@example.com": 2,
  "public_note": "DEMO_PUBLIC",
  "secret": "[REDACTED]"
}

Email addresses used as property names remain visible. The default auth substring would also match author.

Invalid expression blocks partial output

An opening bracket is not a valid expression. Processing shows an error and clears the output and counts; it does not offer partially masked text for copying.

Key expression (case-insensitive): [ · Replacement operations: 0

Input log or JSON

{ "email": "ada@example.com", "password": "DEMO_ONLY" }

Expected error

Invalid key expression. Fix the expression before copying.

Correcting the expression restores processing, but a valid expression does not prove complete detection.

Inspect pattern-based masking before sharing

Paste a synthetic or approved log, review the key expression, then compare the masked text and replacement counts. Valid JSON is parsed first: string values are decoded before matching, and matching keys have their whole value replaced. Other input uses limited text matching. Copy the result only after checking omissions.

The default key expression is case-insensitive and matches substrings. A parent-key replacement counts once and its descendants are not scanned. JSON input is reformatted with two-space indentation. An invalid key expression produces an error, clears the output and blocks copying.

Usage Boundaries & Limitations

  • This is best-effort matching, not DLP, anonymization or a guarantee that sharing is safe. Opaque tokens, unusual email formats, encoded or split secrets and other identifiers can remain visible. Review the whole result.
  • JSON property names stay unchanged to avoid merging distinct keys. Sensitive names, including email addresses used as keys, therefore remain visible. Mask or rename them separately before sharing.
  • The default auth substring also matches author; an IPv4-shaped version such as 1.2.3.4 is masked. JWT-shaped text is matched without validating a signature or claims. A valid IP-shaped candidate need not represent a client address.
  • Plaintext or malformed JSON receives text-pattern masking and limited quoted-key scalar masking. Unquoted keys and object/array values are not reliably covered. The text-mode label does not certify valid or fully redacted JSON.
  • Counts describe replacement operations, not unique people or every secret in a masked parent. Some text-mode matches can be counted before a later key replacement. Zero replacements does not mean no sensitive data.
  • JSON.parse uses JavaScript numbers; large integers may lose precision. Unmasked non-finite JSON numbers are rejected. Custom expressions and conversion run on the main thread; complex expressions and large inputs can slow or freeze the page.
  • The conversion code runs in the browser. These checks do not verify every script or the deployed site. Follow your organization’s data rules; output processing and copying need JavaScript.

Frequently Asked Questions (FAQ)

Does JSON redaction catch escaped emails and nested values?▼

Valid JSON is parsed before matching, so a Unicode-escaped email separator is decoded. Arrays and objects are visited recursively; a matched parent key replaces the whole value before its children are scanned. Property names remain unchanged.

Why did author or a version number get masked?▼

The default expression uses substring matching, so auth also matches author. An IPv4-shaped version is indistinguishable from an address for this pattern matcher. Use an anchored key expression and review both false positives and missed values.

What does text mode mean for an incomplete JSON log?▼

The input did not parse as JSON. General text patterns and quoted-key scalar replacements can still run, but object/array values and unquoted fields may be missed. Repair JSON or manually inspect the remaining text.

Does a masked result guarantee that it is safe to share?▼

No. Patterns can miss opaque, encoded or unfamiliar secrets, and sensitive JSON key names are retained. Replacement counts are not a safety score. Review every field and follow your data-sharing policy.

Recommended Technical Guides

Review API log redaction before sharing→Locate malformed JSON before masking→Understand costly regular expressions→Preserve JSON number identifiers→