When the omit list is fixed at write time, native rest destructuring is the most readable choice and the V8 engine optimises it well. The named binding (password) collects the dropped value, and the ...rest collects everything else into a fresh object. Note that this only does a shallow copy: nested objects under safeUser still share references with the source. Reach for this version inside route handlers or selectors where the omitted keys are known statically.

When the blacklist comes from config, query parameters, or runtime feature flags, you cannot destructure it inline. Building a Set makes membership checks O(1), so the helper runs in O(n) over the entries regardless of blacklist size. Iterating with Object.entries skips inherited and non-enumerable properties, which is exactly what you want for plain data. The example shows how the helper composes naturally with Object.keys(...).filter when the rule is "omit any key matching a pattern".

Sometimes the keys to omit are buried inside nested objects (debug fields, computed metadata, internal IDs). omitDeep recurses into both arrays and plain objects, applying the same blacklist at every level. The base case is any non-object value (including null), which short-circuits the recursion. Watch out for cycles: a self-referential graph will recurse forever, so reach for structuredClone plus a manual prune, or add a WeakSet of visited nodes, when the input may contain cycles.