HAR Sanitizer
Paste a HAR export and redact its secrets and PII — auth/cookie/token headers, secret query params and path segments, and JSON / form / XML / multipart / plain bodies — with a redaction profile, plus your own custom keys and regex patterns for whatever is specific to your stack. The sanitized HAR is the output; the verdict warns if any detected value is still present, and the Findings, Domains, and Timing tabs summarize the capture. Runs in your browser; nothing is uploaded.
Auto-sanitizes as you type. Ctrl+Enter to re-run.
How to use the HAR Sanitizer
Sanitize Chrome, Firefox, or Edge HAR (HTTP Archive) files before sharing API traces with vendors, support, Jira, or GitHub issues. The HAR Sanitizer redacts Authorization headers, cookies, API keys, JWTs, query-string secrets, and sensitive body fields, and produces a sanitized HAR you can attach to a ticket. Useful for incident sharing, vendor support tickets, and offline debugging without leaking session tokens or PII. Runs locally; HAR files never leave your browser.
What it does
- Redacts Authorization (Bearer, Basic), cookies,
X-Api-Key, custom auth, and query secrets (access_token,token,sig). - Scans request and response bodies — JSON, form-encoded, XML, multipart, and plain text — for tokens, JWTs, PII, and secrets.
- Applies a redaction profile (vendor / internal / replay / strict / minimal) and lets you override request/response body handling.
- Warns if any detected value is still present in the sanitized output under the chosen profile — a ground-truth check, not just a claim.
- Summarizes the capture: a Findings list of what was redacted, a Domains report (first-party vs third-party and trackers), and request Timing.
- Handles multi-megabyte HARs from SPAs without uploading anything.
When to use it
- A vendor's support team asks for a HAR file to debug an API integration.
- Attach network logs to a Jira / GitHub issue without leaking session tokens.
- QA is sharing a HAR recording with a third-party contractor.
- You need a sanitized HAR for offline debugging.
- Audit which third-party requests and trackers your app makes.
- Check whether a HAR contains cookies or tokens before sending it.
How to use it
- Export a HAR from Chrome DevTools: Network → right-click → "Save all as HAR with content".
- Paste the HAR JSON into the input.
- Pick a redaction profile — Vendor is the safe default; Strict also removes bodies.
- Read the verdict — it warns if any detected value is still present in the output.
- Review the Findings, Domains, and Timing tabs, then copy or download the sanitized HAR.
- Attach the sanitized output to the ticket. Verify the redactions before sharing.
Tips & pitfalls
- HAR includes full request and response bodies — PII in JSON payloads is a common leak source. Use a profile that redacts or removes bodies, not just headers.
- The sanitized HAR is for sharing, not for live replay — credentials are gone. Re-inject valid credentials in the replay environment.
- The Minimal profile keeps response bodies, so PII in a response can remain — the verdict flags it; switch to Vendor or Strict.
- Strip
Set-Cookieresponse headers before sharing — session cookies are usable until they expire. - Some vendors send tokens in query strings — the sanitizer redacts those too.
- For pure secret detection on arbitrary text, the Secrets Scanner covers more pattern types.
FAQ
- How do I export a HAR from Chrome? Open DevTools → Network → right-click any request → "Save all as HAR with content".
- What does HAR Sanitizer redact? Authorization headers, cookies, common API key headers, query-string secrets, and body fields that match secret / PII patterns.
- Can I replay the sanitized HAR? Not directly — credentials are removed. Re-inject test credentials in your replay environment, or hand the sanitized HAR to the API Debugging Studio or cURL Converter.
- Is the HAR uploaded? No. The HAR is parsed and sanitized entirely in your browser. Nothing is sent to a server.
- Which redaction profile should I use? Vendor for sharing with support (redacts auth, cookies, query and body secrets, PII); Strict to also remove request and response bodies; Minimal for credentials only. The verdict warns if any detected value is still present in the output.
- Can it sanitize response bodies? Yes — JSON, form-encoded, XML, and text bodies are scanned and redacted with the same patterns (unless the profile keeps or removes bodies).
Related tools
- Scan text and .env files for secrets with the Secrets Scanner before sharing.
- Decode JWTs and OAuth tokens found in Authorization headers.
- Verify webhook signatures when debugging signed API callbacks.
- Parse URLs and query strings to spot secrets passed as query parameters.
Use-case guides
Runs locally in your browser. No uploads. Always review redactions before sharing — sensitive data in response bodies is a common leak.
Want to dig into one HAR entry instead of the whole capture? The API Debugging Studio builds a debugging board for a selected entry.
Common tasks solved by this tool
- Sanitize HAR files before sharing with support
- Check whether a HAR file contains cookies or tokens
- Redact Authorization headers from browser network logs
- Remove API keys from request headers and query strings
- Prepare safe browser logs for vendor tickets
Continue in a security debugging workflow
Chain this into related tools, or build it as a saved workflow in Workflows.
- Sanitize the HAR file — this tool
- Scan the output for remaining secrets
- Decode JWTs found in headers
- Verify webhook signatures
Part of the security and debugging toolkit
Sanitize logs, verify signatures, decode tokens and inspect certificates locally before sharing sensitive debugging data.