Are keys hidden too, or just string values?

Only string values are masked; object keys are always left visible, since the point is to show a document's shape while hiding its content.

What happens to numbers, booleans, and null?

They're left completely untouched. Only values with a JSON string type get replaced with asterisks.

Does the mask preserve the original string's length?

Yes, each string is replaced with the same number of asterisks as its original character length, so you can still see roughly how long each value was.

How is this different from Censor JSON Data?

This tool masks every string value regardless of its key name, useful for a quick, blanket redaction. Censor JSON Data instead targets specific keys that look sensitive (password, email, token) and leaves everything else visible.

JSON String Masker Online - Mask Values with Asterisks

Overview

Introduction

Sharing a JSON document's shape, for documentation, a bug report, or a support request, often doesn't require sharing its actual content, especially when that content includes names, addresses, or other text you'd rather not expose.

This tool masks every string value with asterisks while leaving the document's structure fully intact, so the shape is still visible without the data.

What Is JSON String Masker?

A masking tool that walks a JSON document and replaces every string value with a run of asterisks matching its original length, leaving keys, numbers, booleans, null, and the overall nesting completely unchanged.

The result has the exact same shape as the input, just with the text content of every string value hidden.

How JSON String Masker Works

The tool recursively walks the parsed JSON value: for every string it encounters, it emits '*'.repeat(originalLength); for every other value type (number, boolean, null, or a container), the value or structure passes through unmodified.

Keys are never touched by this process, only the values assigned to them, so the document remains just as readable structurally.

When To Use JSON String Masker

Use it when sharing a sample payload's shape with a colleague or in a bug report, without exposing real user data like names or emails.

It's also useful for documentation examples where you want to show a realistic structure without publishing actual sample content.

Often used alongside JSON Redactor, JSON Obfuscator and JSON Formatter & Beautifier.

Features

Advantages

Preserves the document's exact structure and key names.
Masked length hints at the original string's length without revealing content.
Runs entirely client-side, so sensitive data is never uploaded anywhere.

Limitations

Non-string values (numbers, booleans) are left visible, so they can still leak information (e.g. an account balance).
String length itself is preserved, which can sometimes still be a meaningful signal about the hidden content.

Examples

Masking string values

Input

{"username":"ada.lovelace","email":"ada@example.com","id":1,"active":true}

Output

{
  "username": "*************",
  "email": "*****************",
  "id": 1,
  "active": true
}

String values become asterisks of matching length; the numeric id and boolean active pass through unchanged.

Best Practices & Notes

Best Practices

If numbers or booleans in your document are also sensitive, mask or remove them manually after using this tool.
Use Censor JSON Data instead if you only want specific sensitive-looking fields redacted, not every string.
Double-check the masked output before sharing; string length alone can occasionally still reveal information.

Developer Notes

Masking is a straightforward recursive value-type check ('typeof value === "string"') rather than a key-name heuristic, which is what distinguishes this tool from Censor JSON Data: this one is content-agnostic and blanket, while censoring is targeted at specific key names.

JSON String Masker Use Cases

Sharing a JSON payload's structure in a bug report without exposing real user data
Preparing a documentation example with realistic shape but no real content
Reviewing a document's structure with a colleague without revealing sensitive text

Common Mistakes

Assuming numbers and booleans are also hidden; only string values are masked.
Sharing a masked document that still contains a sensitive number (e.g. an ID or amount) unmasked.
Expecting the masked string lengths to be randomized; they intentionally match the original for shape fidelity.

Tips

Combine with manual review of numeric fields before sharing, since this tool only masks strings.
Use Obfuscate JSON instead if you want key names scrambled as well, not just string values.

JSON String Masker