All 10 JSON & Data Serialization questions
More in JSON & Data Serialization
How do you convert a JavaScript object into a JSON string? How do you convert a JSON string back into a JavaScript object? What values does JSON.stringify() silently drop or convert, and why does this matter? How does the reviver function in JSON.parse() work? Why does JSON.stringify() throw a TypeError on objects with circular references, and how do you handle it? How does defining a toJSON() method on a class customize its JSON.stringify() output? What is structuredClone() and how does it differ from JSON.parse(JSON.stringify(obj)) for deep cloning? How do you safely parse potentially untrusted JSON without exposing your app to prototype pollution? How would you stream-parse a very large JSON file without loading it entirely into memory?
Advertisement
Back to results for “JSON”
JavaScript › JSON & Data Serialization

How do you use the replacer parameter of JSON.stringify() to control what gets serialized?

Intermediate

Answer

The second argument can be an array of allowed key names, or a function called for every key/value pair that returns the value to use (or undefined to omit that key) — giving fine-grained control over the output, like excluding sensitive fields.
const user = { name: 'Sam', password: 'secret123' };
JSON.stringify(user, (key, value) => key === 'password' ? undefined : value);
// '{"name":"Sam"}'
Real-world example Excluding a password or internal-only field before sending a user object to a client or logging it.

Common follow-ups: How does the 'space' third argument to JSON.stringify() affect the output?

Security: XSS CSRF & Content Security Policy
All 10 JSON & Data Serialization questions