What this tool does
Support teams and developers often need the shape of a payload rather than the real records inside it. This tool parses valid JSON, walks nested objects and arrays, masks configured sensitive keys, and scans remaining strings for common private patterns.
When the input is invalid JSON, the tool falls back to text redaction and warns through the output behavior. For technical troubleshooting, valid JSON is preferable because nesting and data types are preserved.
Recommended workflow
- Paste a representative sampleUse the smallest payload that still reproduces the issue.
- Redact recursivelyThe tool masks sensitive-looking keys throughout objects and arrays.
- Validate the outputConfirm the result is valid JSON and that IDs needed to explain relationships use consistent placeholders.
- Review custom business fieldsCheck organization-specific keys that an automatic list cannot know.
What it checks
The current tool version is designed to handle the following areas:
- sensitive key names
- emails
- phone numbers
- JWTs
- Bearer tokens
- API-key assignments
- IP addresses
- URLs
- common IDs
Example
Before
{"name":"John Carter","email":"john@example.com","customer_id":"CUST-4501","token":"live-secret"}Safer output
{"name":"[REDACTED]","email":"[REDACTED]","customer_id":"[REDACTED]","token":"[REDACTED]"}Safety checks before sharing
- Inspect every array item, not only the first record
- Remove access and refresh tokens even when expired
- Check URLs for query-string identifiers
- Avoid sharing full production payloads
Representative test coverage
This page is checked with representative examples, not every possible format or file produced by every application.
- API responses
- webhook payloads
- nested arrays
- automation-node outputs
- support examples
Known limitations
Automated processing can miss unusual formats, indirect identifiers, hidden data, unsupported structures, and information that requires human judgment. This tool may miss:
- custom keys with harmless-looking names
- numbers whose meaning depends on context
- nested values encoded as strings
- encrypted or compressed payloads
Do not describe the result as fully anonymous, legally compliant, secure, or impossible to re-identify. Review the exact final artifact before sharing it.
Frequently asked questions
Does JSON PII Redactor upload my input?
The normal tool workflow runs in your browser. The page code is downloaded from the website, but the content you paste or select is processed locally and is not sent to a Privacy Toolbox processing API.
Can this guarantee complete anonymization?
No. Automated checks can miss context clues, unusual identifiers, text inside unsupported files, and details that only a person would recognize. Always review the result before sharing.
Should I use this for regulated or highly sensitive data?
Only when your organization permits it. For medical, legal, financial, employment, or customer data, follow your approved security and compliance process rather than relying on a free pattern-based tool alone.