Is the JSON PII scanner free?
Yes. This JSON PII scanner is completely free to use with no signup or account required.
Does it upload my JSON?
No. The scan runs entirely in your browser on your own device, so the JSON you check is never uploaded to a server and stays private.
Does it scan nested JSON?
Yes. Nested objects and arrays are walked, and every finding is reported with its JSON path so you can locate it.
Is this a legal or compliance tool?
No. It is a heuristic scanner for practical cleanup and review before sharing JSON. It is not a compliance-grade classifier.
Can I export a redacted copy?
Yes. You can export a redacted JSON output with flagged values masked, ready to share more safely.
Is my payload sent anywhere to be scanned?
No. The JSON is parsed with the browser's own JSON.parse and walked in the page. There is no request and no logging. Since the whole reason you are scanning is that the payload might contain secrets, a scanner that uploaded it first would be self-defeating.
How does it decide something is a secret?
Two ways. If the key name matches password, passwd, secret, token, api_key, access_token, auth_token or private_key, the value is redacted purely on the strength of the name. Otherwise the value itself is tested against patterns for an email, a phone number, a URL, an IPv4 address, a run of 7 or more digits, or a token-like string of 24 or more characters.
Why did it miss the customer name in my payload?
Because a name has no pattern. Everything this tool detects has a fixed shape, and a name does not. The same applies to street addresses, free-text notes and anything meaningful only in context. Read the payload yourself as well as running the scan, especially before pasting it into a public issue.
Does it scan nested objects and arrays?
Yes. The walker recurses through the whole structure, and array elements get an indexed path such as $.users[2].email. Note that an array element has no key name, so the key-name rule cannot fire inside a bare array of strings; only the value rules apply there.
Can I use the redacted JSON as a test fixture?
Usually yes, with a caveat: the redacted values are placeholder strings such as [email] and [id], so the types change. A numeric ID becomes the string [id]. If your fixture is fed to something that type-checks, replace the placeholders with well-formed dummy values of the right type.
Why does it say Lite?
Because it is honest about being a heuristic scan rather than a compliance-grade classifier. It is designed for the thirty seconds before you paste a payload into a ticket, a doc or a chat, when the useful question is which fields obviously should not go out. It is not designed to certify that a dataset is clean.