Mask JSON Online — Free PII and Sensitive Data Redactor

Does the JSON Masker send my data to a server?

No. The JSON Masker runs entirely in your web browser using JavaScript. Your JSON data is never sent to MaskJSON servers, never uploaded, and never stored anywhere. Processing happens 100% locally on your device. You can verify this by turning off your internet connection — the tool still works.

Is it safe to use the JSON Masker with production data?

Yes. Because all processing is client-side, it is safe to paste real production data, live API responses, or customer records into the tool. The data never leaves your device. That said, always follow your organization's data handling policies before pasting sensitive information into any browser-based tool.

Which JSON fields does the auto-detect feature find?

The auto-detect feature recognizes 30+ common sensitive field names including: password, passwd, token, api_key, apiKey, secret, authorization, auth, email, ssn, social_security, credit_card, card_number, cvv, pin, phone, address, and more. You can also add custom field names manually.

Can I mask fields inside nested JSON objects?

Yes. The recursive masking option traverses the entire JSON tree — nested objects, arrays of objects, and deeply nested structures are all handled. A field named 'password' will be masked whether it appears at the top level or three levels deep.

What does the masked output look like?

By default, masked values are replaced with three asterisks: ***. You can change the replacement to any string: [REDACTED], null, an empty string "", or a custom placeholder like XXXXX. The JSON structure and all non-sensitive fields are preserved exactly as they were in the input.

Does the JSON Masker work with large JSON files?

Yes. The tool handles JSON files up to several megabytes without performance issues. For very large files (10MB+), processing may take a few seconds depending on your browser and device. There is no file size limit imposed by the server since all processing is local.

Is there an API or command-line version of the JSON Masker?

The browser tool is free for all users. A REST API version is available for MaskJSON Pro subscribers, which allows programmatic masking at up to 10,000 API calls per month. The @maskjson/core npm package is also available for Node.js projects.

How is JSON masking different from JSON encryption?

JSON masking replaces field values with placeholder text — it is one-way and irreversible. Encryption transforms values into ciphertext that can be reversed with a key. Masking is better for logs, test data, and sharing with third parties. Encryption is better for storing or transmitting data that needs to be recovered later.