jsonmask

Mask sensitive fields in JSON streams for safe CI/CD logging. Zero dependencies.

Install

npm install -g @chengyixu/jsonmask

Usage

# Pipe JSON through
echo '{"user":"alice","password":"s3cret"}' | jsonmask

# Read from file
jsonmask --file data.json

# Remove fields instead of masking
cat api.log | jsonmask --remove

# Strict mode: exit 1 if secrets found (CI linting)
cat deploy.json | jsonmask --strict --remove

# Custom keys and mask string
jsonmask --keys apikey,private_key --mask "[REDACTED]"

# Pretty JSON output
curl -s https://api.example.com | jsonmask --json

# Count only
jsonmask --file data.json --count

Options

| Flag | Description | |------|-------------| | --keys <list> | Comma-separated keys to mask | | --mask <str> | Replacement string (default: ***) | | --remove | Remove fields entirely | | --json | Pretty-print output as JSON | | --strict | Exit 1 if any sensitive keys found | | --file <path> | Read from file | | --case-insensitive | Match keys case-insensitively | | --count | Print count of masked fields only | | --help, -h | Show help |

Default masked keys

password, secret, token, api_key, apikey, credential, private_key, access_token

Masks nested objects recursively (leaf values only, container objects are recursed).