fieldmask

Mask sensitive fields from any object before logging, analytics, or API responses.
Zero dependencies. Works anywhere Node.js runs.

const user = {
  name: "John",
  email: "[email protected]",
  password: "supersecret",
  token: "sk-abc123xyz",
  card: "4111111111111234"
};

fieldmask(user).auto().value();
// {
//   name: "John",
//   email: "[email protected]",
//   password: "****",
//   token: "****",
//   card: "****"
// }

Why fieldmask?

You've done this. Every developer has:

// Oops. Password just went to Datadog.
console.log("User login:", req.body);

// Oops. Token just went to Sentry.
logger.info({ user, token, session });

// Oops. Card number just went to your analytics pipeline.
analytics.track("checkout", orderPayload);

fieldmask is the one line you add before any of those calls.

Install

npm install fieldmask

Usage

Auto-detect (recommended)

Masks 50+ common sensitive field names automatically — passwords, tokens, API keys, SSNs, card numbers, bank accounts, and more.

const fieldmask = require('fieldmask');

const result = fieldmask(obj).auto().value();

Mask specific fields only

fieldmask(obj).only(['email', 'phone']).value();

Add your own sensitive keys

fieldmask(obj).auto().add(['internalCode', 'employeeId']).value();

Skip a key even if it looks sensitive

// "token_count" looks sensitive but isn't
fieldmask(obj).auto().skip(['token_count']).value();

Custom mask string

fieldmask(obj).auto().mask('[REDACTED]').value();
// { password: "[REDACTED]" }

Show last N characters (great for card numbers, tokens)

fieldmask(obj).auto().showLast(4).value();
// { card: "****1234", token: "****xyz9" }

Works on nested objects and arrays

fieldmask({
  user: {
    profile: { name: "Alice" },
    auth:    { password: "secret", token: "abc" }
  },
  sessions: [
    { id: 1, token: "tok1" },
    { id: 2, token: "tok2" }
  ]
}).auto().value();

// passwords and tokens masked at every level

Static shorthand

// Quickest way to use it
fieldmask.auto(obj);
fieldmask.only(obj, ['email', 'ssn']);

Return masked JSON string

fieldmask(obj).auto().toJSON();
// → '{"name":"John","password":"****"}'

API

| Method | Description | |---|---| | .auto() | Auto-detect sensitive keys using built-in list | | .only(keys[]) | Mask only these specific keys | | .add(keys[]) | Add extra keys to the auto-detect list | | .skip(keys[]) | Never mask these keys (even if they look sensitive) | | .mask(str) | Custom mask string (default: ****) | | .showLast(n) | Show last N characters of masked value | | .value() | Execute and return the masked object | | .toJSON() | Execute and return masked JSON string | | fieldmask.auto(obj) | Static shorthand for .auto().value() | | fieldmask.only(obj, keys) | Static shorthand for .only(keys).value() | | fieldmask.defaults | Array of all built-in sensitive key names |

Built-in sensitive keys (50+)

password, passwd, token, accessToken, refreshToken, apiKey, api_key, secret, authorization, ssn, card, cardNumber, cvv, pin, privateKey, certificate, otp, sessionId, cookie, dob, bankAccount, salary, passport, license — and more.

See fieldmask.defaults for the full list.

Real-world usage patterns

Safe logging middleware (Express)

app.use((req, res, next) => {
  logger.info({
    method: req.method,
    path: req.path,
    body: fieldmask.auto(req.body)  // ← never log raw body again
  });
  next();
});

Safe error reporting (Sentry / Bugsnag)

Sentry.configureScope(scope => {
  scope.setUser(fieldmask.auto(user));
});

Safe analytics

analytics.track('checkout_completed', fieldmask(payload)
  .auto()
  .add(['internalOrderId'])
  .value()
);

Safe API response scrubbing

res.json(fieldmask(dbRecord).auto().value());

TypeScript

Full type definitions included.

import fieldmask from 'fieldmask';

const safe = fieldmask(user).auto().value();

License

MIT