# How to mask PII in a JSON export and keep it valid

> Mask emails, phones, and IDs in a JSON export without breaking it. Field-guided masking that keeps keys and structure intact.

A JSON export sent to support, analytics, or a vendor carries personal details in predictable places: `email`, `phone`, `address`, `name`, nested user objects, arrays of contacts.
Hand-editing values one by one is slow and error-prone, and a sed script that touches keys as well as values corrupts the structure.
The safe operation replaces only the detected spans and leaves keys, punctuation, and nesting exactly as they were.

## Why fields make detection easier

In prose, an email is found by its shape alone.
In JSON, the key confirms it: a value under `"email"` or `"phone"` is what it says it is, in six languages (`Naam`, `Nom`, `Nombre`, `Nome`, `Vorname` included).
That guidance cuts both error directions at once: fewer real addresses missed, fewer product names misread as people.
Paste the export as-is. There is no need to flatten or reformat it first, and reformatting risks introducing exactly the breakage you are trying to avoid.

## The workflow

Paste the JSON into [the PII masker](/pii-masker#pii-tool).
Detection is offset-based, so masking swaps spans inside string values and the output still parses: keys never change, commas and brackets never move.
Check the pills for the types found, then glance at the highlights view for anything the shapes missed, like an ID format only your system uses.
Teach those with a plain-English rule (`also mask tenant slugs like acme-corp-9 as account_number`) and re-paste; the rule applies instantly.
Copy the masked version into your ticket, vendor upload, or test fixture.

## Verify before you send

Paste the masked output into any JSON validator or run it through `JSON.parse` in a console.
It should parse first time: if it does not, something edited structure rather than values, and that file should not ship.
Then search the masked text for `@` and for a sample of the original digits. A leftover is a miss to fix with a custom rule, not a reason to start over.
For prose threads like chat logs and tickets rather than structured exports, the companion guide is [paste chat logs into AI tools without leaking personal details](/blog/paste-chat-logs-into-ai-without-leaking-pii).

---

Originally published at https://plainkit.tools/blog/mask-pii-in-json-export on Sep 9, 2026.