---
title: "Redact Secrets from JSON Before Sharing - Blobster"
description: "Mask tokens, passwords and cookies in JSON, YAML, CSV and .env files locally before you share them. What Blobster’s redacted copy catches, what it misses and how to check."
canonical: "https://www.mochavi.com/blobster/guides/redact-secrets-before-sharing"
markdown_mirror: "https://www.mochavi.com/blobster/guides/redact-secrets-before-sharing.md"
language: "en"
generated_from: "prerendered HTML"
---

> Canonical HTML: [https://www.mochavi.com/blobster/guides/redact-secrets-before-sharing](https://www.mochavi.com/blobster/guides/redact-secrets-before-sharing)
>
> This machine-readable Markdown mirror is generated from the canonical page during the Mochavi production build.

[Blobster](https://www.mochavi.com/blobster) / [Guides](https://www.mochavi.com/blobster/guides)

Redaction guide

# Redact a payload before it leaves your machine.

Open the payload in Blobster, delete the parts the reader does not need, then use Copy redacted. Blobster replaces the values of secret-looking keys, such as password, token, api\_key, authorization and cookie, with \[REDACTED\]. It matches key names, not values, so read the result before you send it.

Published 14 October 2026 3 minute read By Mochavi

[Install Blobster](https://chromewebstore.google.com/detail/blobster/epddolhfilamhbnmgglenceabjbbeeho) [Read as Markdown](https://www.mochavi.com/blobster/guides/redact-secrets-before-sharing.md)

Short answer

Cut the document down first, redact second and review third. Copy redacted masks values by key name, so anything sensitive under an ordinary key name stays visible.

## Key points

-   Copy redacted is in the Actions menu and the command palette. It works on parsed JSON, YAML, TOML, XML, CSV, TSV, NDJSON and `.env` documents.
-   Matching ignores case and finds the word anywhere in a key, so `refresh_token` and `X-Session-Token` are masked, and so is a harmless `token_count`.
-   In JSON and YAML the whole value under a matching key is replaced, nested objects and arrays included.
-   Values under neutral keys are left alone: a bearer token inside a `note`, an email address, a customer name, an internal hostname.

## What Copy redacted changes

Take a small API response with credentials in three places and an email address in a fourth.

Original payload

```
{
  "user": "ada@example.test",
  "access_token": "eyJhbGciOi...",
  "headers": {
    "Authorization": "Bearer 3f9a1c",
    "X-Request-Id": "req-81"
  },
  "token_count": 412,
  "note": "retried with Bearer 3f9a1c"
}
```

## What comes out

Copy redacted masks `access_token` and `Authorization` because their names match. It also masks `token_count`, which was harmless. The email address and the bearer token inside `note` survive, because nothing about those key names looks secret.

Redacted copy

```
{
  "user": "ada@example.test",
  "access_token": "[REDACTED]",
  "headers": {
    "Authorization": "[REDACTED]",
    "X-Request-Id": "req-81"
  },
  "token_count": "[REDACTED]",
  "note": "retried with Bearer 3f9a1c"
}
```

## Cut first, then redact

Redaction keeps the shape of the document. A 2,000-line response is still 2,000 lines after masking, with every customer field and internal URL that was in it. Remove what the reader does not need before you copy.

Delete branches in the tree or rows in the table. Edits stay in a local draft, Copy redacted uses that draft, and Reset draft brings the original back.

## What key-name matching misses

-   Secrets under ordinary key names such as `value`, `data`, `message` or `note`.
-   Secrets inside longer strings, such as a token in a log line, a password in a connection string or a signature in a URL query.
-   Personal data, including names, email addresses, phone numbers and IP addresses.
-   Values that are sensitive only in context, such as internal hostnames, account IDs and order numbers.

## Redaction needs a parsed document

Copy redacted works on the parsed structure. If a large file opened in Raw first, use `Parse now` before you copy, and fix any syntax error the document reports. Markdown and plain text have no keys to match.

YAML, TOML and XML come back normalised, with the same data but without the original comments or formatting. CSV, TSV and NDJSON are redacted by column name, and `.env` files by variable name.

## Check the output before you send it

Search the copied text for `Bearer`, for `eyJ` (most JWTs start with it), for `@` and for your own domain names.

HAR captures store headers, cookies and query parameters as name and value pairs. For a HAR, Copy redacted and the HAR preview’s Copy sanitized HAR mask those values by name, and also mask Bearer and Basic credentials inside request and response text. Chrome DevTools exports a sanitised HAR by default, without `Cookie`, `Set-Cookie` and `Authorization` headers, so start from that export when you can, and still read the result.

## Sources

-   [Chrome DevTools network reference: save requests as HAR](https://developer.chrome.com/docs/devtools/network/reference#save-as-har)
-   [RFC 7519: JSON Web Token](https://www.rfc-editor.org/rfc/rfc7519)
-   [Blobster privacy policy](https://www.mochavi.com/privacy/blobster)

Related

[Keep production JSON local→](https://www.mochavi.com/blobster/guides/keep-production-json-local)[Inspect HAR files safely→](https://www.mochavi.com/blobster/guides/inspect-har-files-safely)[Blobster vs jsonformatter.org→](https://www.mochavi.com/blobster/compare/jsonformatter-org)

Machine-readable

[Markdown version→](https://www.mochavi.com/blobster/guides/redact-secrets-before-sharing.md) [Blobster RSS feed→](https://www.mochavi.com/blobster/feed.xml)

Local-first workbench

## Inspect the data. Keep the document local.

Open JSON, logs, tokens, configs and tables in Blobster without adding an account, telemetry or a public paste URL.

[Install from Chrome Web Store](https://chromewebstore.google.com/detail/blobster/epddolhfilamhbnmgglenceabjbbeeho)