Redact Secrets from JSON Before Sharing

Short answer

Cut the document down first, redact second and review third. Copy redacted masks values by key name, so anything sensitive under an ordinary key name stays visible.

Key points

Copy redacted is in the Actions menu and the command palette. It works on parsed JSON, YAML, TOML, XML, CSV, TSV, NDJSON and .env documents.
Matching ignores case and finds the word anywhere in a key, so refresh_token and X-Session-Token are masked, and so is a harmless token_count.
In JSON and YAML the whole value under a matching key is replaced, nested objects and arrays included.
Values under neutral keys are left alone: a bearer token inside a note, an email address, a customer name, an internal hostname.

What Copy redacted changes

Take a small API response with credentials in three places and an email address in a fourth.

Original payload

{
  "user": "ada@example.test",
  "access_token": "eyJhbGciOi...",
  "headers": {
    "Authorization": "Bearer 3f9a1c",
    "X-Request-Id": "req-81"
  },
  "token_count": 412,
  "note": "retried with Bearer 3f9a1c"
}

What comes out

Copy redacted masks access_token and Authorization because their names match. It also masks token_count, which was harmless. The email address and the bearer token inside note survive, because nothing about those key names looks secret.

Redacted copy

{
  "user": "ada@example.test",
  "access_token": "[REDACTED]",
  "headers": {
    "Authorization": "[REDACTED]",
    "X-Request-Id": "req-81"
  },
  "token_count": "[REDACTED]",
  "note": "retried with Bearer 3f9a1c"
}

Cut first, then redact

Redaction keeps the shape of the document. A 2,000-line response is still 2,000 lines after masking, with every customer field and internal URL that was in it. Remove what the reader does not need before you copy.

Delete branches in the tree or rows in the table. Edits stay in a local draft, Copy redacted uses that draft, and Reset draft brings the original back.

What key-name matching misses

Secrets under ordinary key names such as value, data, message or note.
Secrets inside longer strings, such as a token in a log line, a password in a connection string or a signature in a URL query.
Personal data, including names, email addresses, phone numbers and IP addresses.
Values that are sensitive only in context, such as internal hostnames, account IDs and order numbers.

Redaction needs a parsed document

Copy redacted works on the parsed structure. If a large file opened in Raw first, use Parse now before you copy, and fix any syntax error the document reports. Markdown and plain text have no keys to match.

YAML, TOML and XML come back normalised, with the same data but without the original comments or formatting. CSV, TSV and NDJSON are redacted by column name, and .env files by variable name.

Check the output before you send it

Search the copied text for Bearer, for eyJ (most JWTs start with it), for @ and for your own domain names.

HAR captures store headers, cookies and query parameters as name and value pairs. For a HAR, Copy redacted and the HAR preview’s Copy sanitized HAR mask those values by name, and also mask Bearer and Basic credentials inside request and response text. Chrome DevTools exports a sanitised HAR by default, without Cookie, Set-Cookie and Authorization headers, so start from that export when you can, and still read the result.

Redact a payload before it leaves your machine.