The overlooked second argument
Most JavaScript developers use JSON.stringify(object) and stop there. The second parameter, the replacer, gets passed null or ignored entirely. That's leaving capability on the table.
The replacer accepts either a function or an array. Functions let you transform values during serialization. Arrays whitelist specific properties. Both matter for production APIs.
Why this matters for enterprise tech
API responses often contain objects with sensitive data, circular references, or non-JSON types (functions, Sets, undefined values). Filtering at serialization is cleaner than pre-processing objects.
Example: excluding passwords from user objects.
const user = { name: "Alice", email: "alice@example.com", password: "secret123" };
JSON.stringify(user, (key, value) => key === "password" ? undefined : value);
// Output: {"name":"Alice","email":"alice@example.com"}
Array replacers work differently. They specify which properties to include:
const data = [{ name: "Project A", budget: 50000, internal_notes: "confidential" }];
JSON.stringify(data, ["name", "budget"], 2);
// Excludes internal_notes entirely
Common patterns
Filtering properties: Arrays for known schemas, functions for dynamic logic.
Type conversion: Transform Sets to arrays, Dates to timestamps, BigInts to strings.
Circular reference handling: Track objects in a WeakSet inside the replacer function. Return undefined when a circular reference is detected.
const seen = new WeakSet();
JSON.stringify(obj, (key, value) => {
if (typeof value === "object" && value !== null) {
if (seen.has(value)) return undefined;
seen.add(value);
}
return value;
});
Performance context
V8's Dragonbox upgrade (noted in 2020) more than doubled JSON.stringify performance for number-heavy payloads through hidden class caching. That matters for high-throughput APIs serializing large datasets.
The replacer adds minimal overhead. For most enterprise use cases (sub-megabyte responses), the filtering logic is faster than preprocessing objects.
What to watch
Developers often discover the replacer when debugging circular reference errors or when regulations require field-level data exclusion. By then, objects are already shaped wrong.
Better approach: design APIs with serialization in mind. Know what goes over the wire. Use the replacer to enforce it.
The fine print
The third parameter (space) controls pretty-printing. Set it to 2 for human-readable JSON in logs, null for production. Unrelated to filtering, but commonly paired with replacers in examples.
Symbols are always excluded. Functions and undefined values disappear unless the replacer explicitly converts them. Dates serialize to ISO strings automatically, which may or may not be what you want.
This isn't new technology. It's a 2020 reminder that core JavaScript features solve problems developers often reach for libraries to fix.