Masking rulesValues are matched by field name (contains match — e.g. "password" hits any key containing password); optionally detect common sensitive values (email / phone / ID). Mask mode replaces with ***, hash mode replaces with a SHA-256 / HMAC hash (pseudonymization: linkable, irreversible). Structure is preserved.

JSON source

Load JSON

Masked

Masked output will appear here

Mask before you paste logs

JSON Mask

Mask or hash · by field name / common sensitive values · keep structure · local

🔒Processed locally in your browser — never uploaded or stored

No upload, no storage

JSON is processed in memory and never sent to a server.

Share via URL fragment

Share links encode data in the # anchor — never sent to a server.

Remember last edit

Optionally keep your last input locally; clear it with one click.

Why use JSON Mask

Mask by field

Name fields like password, token, phone (contains match) and replace values with *** or keep the ends.

Detect sensitive values

Optionally auto-detect emails, phone numbers and IDs and process them without listing every field.

Field hashing

Replace values with SHA-256 / HMAC-SHA-256 hashes: same value, same hash — linkable across tables yet irreversible. Great for GDPR pseudonymization.

Local is the real moat

The data you mask is exactly the private data; running fully in your browser is what makes it safe.

Use before logs / issues

Scrub sensitive data before pasting JSON into tickets, logs or chats.