fast-redact

fast-redact is a tiny, dependency-free Node.js library that removes or masks sensitive values from JavaScript objects before serialization. Given a set of paths (with dot, bracket, and wildcard syntax), it compiles a purpose-built redaction function at initialization time so that censoring keys adds almost no overhead on top of JSON.stringify.

It is the redaction engine behind the popular Pino logger and is designed for GDPR-safe, high-throughput logging where scrubbing cookies, tokens, and personal data from every log line must be effectively free.

What You Get

• A redactor factory that compiles a fast, path-specific censoring function from a paths array
• Dot, bracket, and wildcard path syntax (including intermediate wildcards like *.c.d and a[*].c.d)
• Configurable censor value, key removal, custom serializers, and a non-serializing mode with a restore() method
• Zero runtime dependencies and a permissive MIT license

Common Use Cases

• Scrubbing cookies, authorization headers, and tokens from request objects before logging
• Redacting personally identifiable information for GDPR-compliant log output
• Powering redaction in logging libraries such as Pino across high-volume services

Under The Hood

Architecture - The public entry point index.js normalizes options (paths, serialize, censor, remove, strict) and orchestrates a small pipeline of single-purpose modules: lib/validator.js guards each path against injection, lib/parse.js splits paths into a secret map and a wildcards list, lib/redactor.js compiles a bespoke redaction function, and lib/state.js, lib/modifiers.js, and lib/restorer.js carry mutable state, wildcard traversal, and value restoration. The compiled redactor mutates the original object in place, serializes it, then restores the original values, making default usage effectively atomic.

Tech Stack - Pure JavaScript targeting Node.js >=6 with zero runtime dependencies. It leans on the built-in Function constructor for code generation and JSON.stringify as the default serializer. Tooling uses tap for tests, standard plus snazzy for linting, and fastbench for benchmarks.

Code Quality - The codebase is small, cohesive, and reports 100% statement, branch, function, and line coverage across all lib files with 224 passing tests. Each module has a single responsibility, and paths are validated defensively (rejecting newlines, semicolons, and comment sequences) before any function is compiled, mitigating the risks of dynamic code generation.

API Design - The surface is a single factory: require('fast-redact')({ paths, censor, serialize, remove, strict }) returns a redactor function, with an optional restore() method in non-serializing mode. Options are discoverable and well documented in the README, path syntax mirrors ordinary JavaScript property access, and getting started requires only a paths array, keeping boilerplate minimal.