---
title: "Keep push payloads short and safe on a · Agent Wranglers"
url: https://agentwranglers.se/playbook/notifications/push-notifications/push-payload-privacy
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep push payloads short and safe on a lock screen

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Push notifications](https://agentwranglers.se/playbook/notifications/push-notifications)
- Rule: Put no secrets, codes, health or money details in a push. Show a neutral line and the details only after sign-in. Keep the payload JSON at or under 3,993 bytes.
- How: Push text shows on lock screens and smart watches, and passes through the platform's servers. Apple's guidelines (4.5.4) say not to send sensitive personal data by push. Write "A new message from your clinic", not the message. Send an ID and let the app fetch the details over its own API. APNs and FCM limit a standard payload to 4,096 bytes. Web push services accept 4,096 bytes after encryption, which leaves 3,993 bytes for your JSON. The same idea for email is [send only what the message needs](https://agentwranglers.se/playbook/email/email-privacy/email-data-minimisation).
- Check: A unit test renders every push template with sample data and fails if the text holds a sign-in code, an amount or a card number. It also fails if the JSON is over 3,993 bytes.

Example:

```js
const MAX_PAYLOAD_BYTES = 3993;
const SENSITIVE = /\b\d{6}\b|\b\d{4}[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b|[$€£]\s?\d/;

test.each(Object.keys(PUSH_TEMPLATES))('%s is safe on a lock screen', type => {
  const payload = JSON.stringify(renderPush(type, SAMPLE_DATA[type]));
  expect(payload).not.toMatch(SENSITIVE);
  expect(Buffer.byteLength(payload)).toBeLessThanOrEqual(MAX_PAYLOAD_BYTES);
});
```

```python
import json
import re
import pytest

MAX_PAYLOAD_BYTES = 3993
SENSITIVE = re.compile(r"\b\d{6}\b|\b\d{4}[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b|[$€£]\s?\d")

@pytest.mark.parametrize("kind", PUSH_TEMPLATES)
def test_push_is_safe_on_lock_screen(kind):
    payload = json.dumps(render_push(kind, SAMPLE_DATA[kind]))
    assert not SENSITIVE.search(payload)
    assert len(payload.encode()) <= MAX_PAYLOAD_BYTES
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers notifications playbook: https://agentwranglers.se/playbook/notifications/push-notifications/push-payload-privacy`.

- Previous: [Delete dead subscriptions and tokens at once](https://agentwranglers.se/playbook/notifications/push-notifications/prune-push-subscriptions)
- Next: [Open the exact page the push is about](https://agentwranglers.se/playbook/notifications/push-notifications/push-deep-links)
- [Push notifications](https://agentwranglers.se/playbook/notifications/push-notifications)