Skip to main content
coltool
中文

Mask Sensitive JSON Data Online

Mask sensitive field values in JSON with one click so you can share API data safely.

What does this tool do?

Sharing API payloads with a coworker, sending sample data to a vendor, pasting production JSON into a support ticket — real-world JSON is full of phone numbers, names, addresses and balances. Replacing them by hand is slow and error-prone. This tool replaces every value in your JSON with a random value of the same type and similar length: strings become random characters of equal length, numbers keep their digit count, booleans flip randomly — while the object structure, keys and array lengths stay exactly the same.

The masked output keeps the full “shape” of the original payload, so the recipient can inspect fields, reproduce the structure and write parsing code as usual — without seeing any real data. Everything runs locally in your browser; your JSON input is never uploaded.

How to use

  1. Paste your sensitive JSON into the left textarea;
  2. Click “Mask” — a structurally identical, randomized JSON appears on the right;
  3. Click “Copy result” and share it safely.

FAQ

Can masked data be reversed?
No. Every value is randomly generated with no mapping back to the original, so the output is safe to share.
Is my JSON uploaded to a server?
No. Your JSON input and masking stay entirely in your browser and never leave your device. The site only uses Cloudflare to collect anonymous usage and performance metrics.
Which data types are supported?
All JSON types: strings, numbers (including negatives and decimals), booleans, null, plus arbitrarily nested objects and arrays. Structure and keys are preserved; only values are replaced.
Why are masked strings capped at 20 characters?
To keep the output readable when the input contains very long text (base64 blobs, long addresses). Strings keep their original length up to a 20-character cap, which does not affect structural comparison or integration testing.