HAR Sanitizer — Remove Cookies, Tokens and Personal Data From HAR Files

Free HAR sanitizer that runs in your browser. Strip cookies, auth headers, tokens, emails and IPs from HAR files before sharing them with support. Nothing is uploaded.

What it does

The HAR Sanitizer takes a HAR file — the network recording you export from Chrome, Firefox, Safari or Edge DevTools — and gives you back a copy with the sensitive parts removed. Cookies, Authorization headers, API keys, session tokens, passwords in form bodies, JWTs, email addresses, IP addresses and card numbers are replaced with placeholders, while timings, status codes and the request flow stay intact. That means a support engineer can still debug the problem, and you haven’t handed them your login.

Before anything changes, it scans the file and shows what it found, with counts and examples. After sanitizing, it re-scans its own output, and you can paste any secret you know was in the original to confirm it is really gone.

A HAR file is a full record of a browsing session, not just a list of URLs. It contains every request and response header, every cookie, the bodies of API calls and often a valid session token. Anyone who gets an unsanitized HAR can often replay a logged-in session. Browsers do not warn you about this when you export one. If you just want to see which cookies and storage entries a site has set in your own browser, the Cookie / LocalStorage Inspector shows them without a recording.

How it works

Everything is parsed and rewritten inside your browser tab. The tool walks each entry in the HAR and applies several layers of rules:

By name. Known sensitive headers (Authorization, X-API-Key, CSRF tokens, signatures), cookies, URL query parameters (token, signature, OAuth code, AWS X-Amz-*) and body fields (password, client_secret, accessToken) are redacted wherever they appear, including inside nested JSON and multipart forms. Names that merely look sensitive are caught too, and you can keep or add names.
By pattern. Text is checked for JWTs (the JWT decoder will show you what claims one carries before you decide to keep or drop it), cloud and API keys (AWS, GitHub, Slack, Stripe, Google and similar), private-key blocks, Bearer/Basic credentials, emails, IPv4/IPv6 addresses and card numbers. Card numbers must pass the Luhn check and match a real card prefix, so ordinary long numbers such as timestamps are left alone.
By randomness. An optional heuristic flags long random-looking strings in cookies, query values, JSON values and URL paths.
Inside encodings. Base64-encoded response bodies are decoded, cleaned and re-encoded; URL-encoded values are decoded before checking; URLs nested inside other URLs or inside HTML/JSON bodies are cleaned too.
Consistently. The same value always becomes the same placeholder ([COOKIE_1], [EMAIL_2]), in the cookie header, the cookie list, the URL and the query-string list alike. Two requests that shared a token still visibly share one, so the sequence of events stays readable. You can switch to short hash placeholders or a plain [REDACTED].

Beyond redaction you can mask hostnames, drop whole entries (tracker hosts, preflight requests, images, anything matching a URL fragment), remove response bodies by type, strip browser-specific fields, and shift every timestamp by one random offset so relative timing survives.

How to use it

Export your HAR from the browser (in Chrome DevTools: Network tab → right-click → Save all as HAR with content), then drop the file onto the tool, or paste the JSON.
Pick a preset: Support (default, keeps hostnames and performance data), Strict, Secrets only or Public (for public bug reports). Fine-tune any option; every change re-runs automatically.
Read the “Found in this file” and “What changed” summaries, and open Inspect entries to compare any request before and after, with the changes highlighted.
Optionally paste values you know were in the original into the known-secret check to prove they were removed.
Download the sanitized .har. A redaction report (counts only — never the secrets themselves) is available to attach to a ticket.

Presets and options

Preset	Good for	Keeps	Removes
Support	Sending to a vendor or your own support team	Hostnames, performance data, bodies	Credentials, tokens, emails, IPs, card numbers
Strict	Anything leaving your organisation	Timings and status codes	Everything above plus personal fields, hostnames, trackers, binary bodies, browser metadata; timestamps shifted
Secrets only	Internal debugging	Emails, IPs, hostnames	Credentials, tokens, keys, cards
Public	Public bug reports	Hostnames you whitelist	Credentials and personal data, hostnames, trackers, media

Supported formats

HAR 1.2 files (.har) and .json exports from Chrome, Edge, Firefox and Safari, including Chrome’s extra _ fields.
Request and response bodies in JSON, form-urlencoded, multipart/form-data, HTML, JavaScript and plain text, plain or base64-encoded.
Several files at once, downloaded individually or as one .zip with a report for each.

Limitations

Pattern matching can’t recognise every kind of secret. A password in free text, or a secret with no recognisable shape and no telling field name, can slip through. Always skim the sanitized file, and add your own text or regex rules for anything specific to you. For plain text such as pasted log lines, the Sensitive Data Masker and the Log File Noise Filter & Anonymizer apply similar masking outside a HAR.
Binary response bodies (images, PDFs, archives) are not inspected; use “Remove bodies by type” if they might contain anything sensitive.
If a JSON body is changed, it is re-written; whitespace is preserved but very large integers (over 15–16 digits) can lose precision in that body.
The high-entropy heuristic can occasionally redact harmless random-looking IDs; turn it off or raise the threshold if it does.
Very large captures (hundreds of MB) depend on your browser’s memory; dropping bodies by type first makes them manageable.

Privacy

Everything in this tool is local. Your HAR is read, scanned and rewritten in your browser; no file, request, cookie or token is uploaded, and no feature in this tool contacts the internet with your data.

Two things to know:

Saved copy. So your work survives a refresh, the tool keeps your original file in your browser’s own storage (IndexedDB) on this device. That original still contains the secrets, so use Clear saved files & settings when you’re finished. Your options and custom rules are saved in the same way. The known-secret check values and the optional mapping file are never saved.
Libraries. The first time you download a .zip, the tool may fetch a small open-source zip library from a public CDN. That request carries none of your data.

FAQ

What is a HAR file and why would I sanitize it?

A HAR (HTTP Archive) file is a JSON recording of everything a browser did on the network during a session. Support teams ask for one to diagnose problems, but it normally includes cookies, auth headers, tokens and form data, enough to impersonate you. Sanitizing removes that while keeping the request/response structure they need.

Will the sanitized HAR still work for troubleshooting?

Yes. Status codes, methods, timings, sizes, header names, and the order of requests are preserved. Consistent placeholders mean that a token used in several requests still shows as one value. The “Support” and “Secrets only” presets keep hostnames and bodies for exactly this reason. Once you have the failing request isolated, the cURL ↔ fetch() converter turns it into a command you can replay yourself.

Can I be sure every secret was removed?

No tool can promise that. This one scans the output again for known patterns and lets you paste specific values to confirm they are gone, but a secret with no recognisable shape can survive. Use the before/after inspector, add your own rules for anything specific to your product, and review the file before sending it.

Does it work with Chrome, Firefox and Safari HAR files?

Yes. Chrome and Edge exports (including their _ extension fields), Firefox exports and Safari exports are all accepted; fields the tool doesn’t recognise are scanned as text rather than rejected.

Can I get the original values back?

Only if you ask for it. You can download an optional mapping file that lists each placeholder next to the real value. It contains the secrets, so keep it private and never send it with the sanitized HAR. The [REDACTED] style does not keep a mapping at all.

Is there a file size limit?

There is no fixed limit, but everything runs in your browser’s memory. Files above about 25 MB show a warning, and for files above about 8 MB the tool waits for you to click “Re-run” after changing settings. For huge captures, remove bodies by type first.