HAR Sanitizer
Redact cookies, authentication headers, sensitive query values, and optionally request and response bodies from a HAR file without removing entries. This reduces common secret exposure but cannot identify every sensitive value.
About HAR Sanitizer
HAR Sanitize strips the secrets out of a browser network capture — cookies, auth headers, API keys, session tokens — so you can share the .har file with a support team or attach it to a bug report without handing over your logins. The file stays loadable in DevTools, and the whole sanitization runs in your browser, which is the only sensible place to clean a file this sensitive.
- Category
- privacy
- Input
- Accepts: application/json or text/plain.
- Output
- Outputs: application/json.
- Cost
- Free, runs in your browser
- Memory
- medium
Common uses
- Clean a HAR before attaching it to a vendor support ticket
- Share a repro capture in a public issue without leaking your session
- Sanitize a teammate's capture before archiving it
- Strip tokens from a capture before pasting requests into documentation
- Audit what a capture would have leaked before you share it
Frequently asked questions
What gets redacted?
Cookies (both the cookie arrays and Cookie/Set-Cookie headers), authorization headers (Authorization, X-Api-Key and friends), and query-string values whose names look secret-bearing (token, key, session, signature...). Optionally request and response bodies too.
Will the file still open in DevTools?
Yes. Values are replaced with [REDACTED] in place — no entries are removed, so timings and structure survive.
How do I know what was changed?
The sanitized file includes a summary block with counts of every redaction made.
Why does sanitizing locally matter?
A HAR file contains your cookies and tokens — exactly the things you shouldn't paste into a random website. This tool never uploads the capture.
Does it redact request bodies?
Only if you enable that option — bodies often contain the payload someone needs to debug, so it's off by default.
Keywords
- har
- http archive
- sanitize
- redact
- cookies
- authorization
- query token
- privacy
- devtools