How to use the json secret scanner
- Paste the JSON you plan to share.
- Review each "possible secret" with its path and the reason it was flagged.
- Untick any false positives, such as public IDs.
- Choose a redaction style: full mask, partial, label or hash.
- Apply redaction and copy the safe version with Ctrl/Cmd+Alt+C.
Features
- Pattern detection: Recognizes well-known key formats plus JWTs and PEM private keys.
- Key-name hints: Values under keys like password, secret, token or apiKey are flagged regardless of format.
- Paths: Each finding shows its location, such as $.services[2].env.API_KEY.
- Structure kept: Only flagged values change; keys, nesting and other values stay as they were.
Example
Config → redacted (label style)
Input
{"region":"us-east-1","key":"AKIAIOSFODNN7EXAMPLE","password":"hunter2"}Output
{"region":"us-east-1","key":"[REDACTED:aws_access_key]","password":"[REDACTED:password]"}AKIAIOSFODNN7EXAMPLE is AWS's documented example key, not a real credential.
Secret types detected
| Type | How it is recognized | Example shape |
|---|---|---|
| AWS access key ID | AKIA or ASIA prefix + 16 uppercase letters/digits | AKIA…(20 chars) |
| JSON Web Token | Three base64url parts separated by dots, header starting eyJ | eyJhbGciOi….eyJzdWIi….sig |
| PEM private key | -----BEGIN … PRIVATE KEY----- block | -----BEGIN RSA PRIVATE KEY----- |
| Connection string | URL with user:password@ in it | postgres://app:pw@db:5432/x |
| Common SaaS API keys | Documented vendor prefixes | sk_live_…, ghp_…, xoxb-… |
| Named secrets | Value under a key such as password, secret, token, apiKey | "password": "hunter2" |
Redaction modes
Examples use a 32-character token, 0123456789abcdef0123456789abcdef, and a 7-character password, hunter2.
| Mode | 32-char token becomes | hunter2 becomes | Best for |
|---|---|---|---|
| Full mask | ******** | ******** | Sharing publicly; reveals nothing, not even length. |
| Partial | 01…ef | ******** | Telling keys apart in a ticket. Only values of 24+ chars show the first 2 and last 2; shorter ones are fully masked. |
| Label | [REDACTED:api_key] | [REDACTED:password] | Bug reports where the reader needs to know what was there. |
| Hash | sha256:3f9a1c2b7e40 | sha256:… | Showing that two values in the same redaction were identical without revealing either (hashes are salted per redaction, so they don't match across runs). |
False positives and false negatives
Long random-looking strings such as UUIDs, commit hashes and content checksums can resemble tokens, so untick them before redacting. In the other direction, a custom token with no known prefix stored under a neutral key such as "value" can slip through. Treat a clean scan as a useful check, not a guarantee, and read the payload yourself before posting it publicly.
JSON Secret Scanner FAQ
How do I hide API keys in JSON before sharing it?
Paste the JSON here, review the flagged values and apply redaction. The output replaces each secret with a mask, label or hash while keeping the structure intact.
What kinds of secrets does it detect?
Cloud access keys, common SaaS API key formats, JSON Web Tokens, PEM private keys, connection strings with passwords, and values stored under names such as password, secret or token.
Will it catch every secret?
No scanner can. Random-looking custom tokens without a known format or telling key name can be missed.
Why does partial redaction hide short values completely?
Showing 4 characters of a 7-character password gives away most of it. So partial mode only reveals the first 2 and last 2 characters of values at least 24 characters long; anything shorter is fully masked.
What should I do if I already shared a key?
Rotate it immediately at the provider, then review access logs. Deleting the paste does not help if someone has already copied the key.
Can hash redaction be reversed?
No. The hash is one-way and shortened, so it cannot be turned back into the key, but equal inputs give equal hashes.
Is it safe to paste API keys into an online JSON formatter?
Only if the tool processes data locally and stores nothing. Some online formatters have offered save or share features that made pasted content publicly viewable; redact first when unsure.