TinyPDF.in logo
Tools › JSON

Make JSON Safe for LLMs

Redact, mask, and hide sensitive values before pasting JSON into an LLM.

🔒 Everything happens locally in your browser.
Your JSON and mapping are not uploaded to a server by this page.
How to use this tool
  1. Upload or paste your JSON — use the Upload button or paste directly into the left-hand editor.
  2. Click Analyze — the tool scans every value and flags likely-sensitive fields (emails, names, phone numbers, tokens, IDs) based on the protection level you choose.
  3. Review detected values — check the Detected Values list below the editor and adjust or override any flagged item before masking.
  4. Click Make JSON Safe — this replaces sensitive values with safe placeholders while preserving the JSON's structure, so an LLM can still reason about it correctly.
  5. Copy or download the safe JSON and paste it into your LLM conversation instead of the original.
  6. Keep the local mapping (shown at the bottom, never upload it) if you need to reverse the substitutions once the LLM responds.

Choose Basic for light masking of obvious identifiers, Standard for typical sensitive-field detection, or Aggressive if you want the tool to err on the side of masking anything that could plausibly be identifying.

Protection:
Original JSON
Interactive JSON Click a detected value
Analyze JSON to see the interactive tree.
Detected Values
No analysis performed yet.
⚙ Advanced — Rule Book

Save your masking decisions as a rule book, then reuse them next time you paste JSON with the same shape — no need to re-review every field. 

{
  "rules": [
    { "path": "$.customer.email", "action": "replace", "replacement": "EMAIL_001" }
  ]
}

Export saves your current review as a rule book like the one above. Import loads one back in, so the same paths get masked automatically.



Local Mapping ⚠ Never paste this into the LLM 
{}

Why redact or hide sensitive data in JSON before pasting it into an LLM?

When you paste JSON into ChatGPT, Claude, or any other LLM to debug an API response, explain a data structure, or generate code around it, you're often sharing more than you intend to. Real-world JSON — API responses, database exports, log samples, configuration files — frequently contains emails, full names, phone numbers, internal IDs, access tokens, or other identifying values mixed in with the structural data the LLM actually needs to help you.

Most LLM providers may retain conversation content for abuse monitoring, product improvement, or a limited retention window, depending on the account type and settings in use. Once sensitive values are in a conversation, you generally can't guarantee they're fully erased from every system that touched that request. For personal data, credentials, or client information, that's a real and avoidable risk.

How this tool redacts and hides sensitive data

What it doesn't do

This tool doesn't send your JSON anywhere for analysis — detection runs entirely in your browser. That also means it isn't a substitute for a full data classification or compliance review if you're handling regulated data (health records, financial data, government IDs) at scale; use it as a fast, practical safety net for everyday LLM use, not as a certified redaction tool for regulatory purposes.

☕ Buy Me a Coffee
🤖 Use this tool from an AI agent (WebMCP)

This page offers 2 tools that an AI agent running in the browser can call directly, without clicking through the page. A call runs in your tab like the buttons do, and nothing is uploaded.

How to turn it on and try it

  1. Use Chrome 149 or later on a computer. TinyPDF.in is enrolled in Chrome's WebMCP trial, so there is nothing to switch on.
  2. Keep this page open and open the console (F12, then Console).
  3. Paste this:
const tools = await document.modelContext.getTools();
const tool = tools.find(t => t.name === 'find_sensitive_values_in_json');
await document.modelContext.executeTool(tool, JSON.stringify({
  "json": "{\"customer\":{\"name\":\"Priya Raman\",\"email\":\"priya@example.com\"},\"total\":499}"
}));

In other browsers the page works as usual and offers no agent tools. Examples for every tool and what they return

Using a desktop agent such as Claude Code or Cursor? See how to connect it to this page.