#!/usr/bin/perl -l

# http://perlmonks.org/?node_id=1206551

use strict;
use warnings;

my $param = 'password';
for ( q~{'password' => 'secret'}~, q~{"password" => "sec\"ret"}~ )
  {
  local $_ = $_;
  s/
        (                   # capture everything up to the start of th
+e value
          (                   # capture the quotation mark we are usin
+g
            (?<!\\\\)         # not escaped
            [ ' " ]           # either kind of quote
          )                   # end capture quotation mark
          $param              # the key
          \2                  # the same quotation mark
          \s*                 # any amount of space
          (?: => | : )        # perl or JSON key-value "connector"
          \s*                 # any amount of space
          \2                  # the same quotation mark
        )                   # end capture everything up to start of th
+e value
        (?:                 # group but do not capture the value
          \\. | (?!\2) .    # defined as any character except the same
+ quote
        )*                  # any number of times
    /$1***/smxg;            # the closing quotation mark will remain i
+n place

  print $_;
  }
[download]

Outputs:

{'password' => '***'}
{"password" => "***"}
[download]