日本語English

HAR Sanitizer

Load a HAR saved from your browser developer tools and save a copy with cookies, auth headers, URL tokens, passwords and JWTs redacted, before you send it to support. A helper only — it cannot guarantee that every secret is found. The HAR never leaves your device.

On-device・No uploadMobile friendlyWorks offlineBeta

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

This is a helper
It cannot guarantee that every secret is found. Custom formats and text inside images or binary data are not detected. Check the “possibly not redacted” list and the content yourself before sharing. The HAR never leaves your device.

Drop a HAR file

or

.har (JSON), up to 100 MB. The file is not uploaded.Accepts: HAR / JSONUp to 100 MB per filePaste (Ctrl+V) also works
Targets (anything you turn off stays as it is)
Response bodies
Replace with
Add a HAR file or press “Try a sample” to see the result here.

How to use

  1. session.har

    Open the HAR

  2. Cookie and Authorization
    Tokens in URLs, JWTs etc.

    Replace the secret values

  3. session_redacted.harwarns on leftovers

    Compare before and save

Replace secret values in a HAR with [REDACTED] so it can be shared safely

  1. Drop a .har saved from the Network tab of your developer tools (“Save all as HAR”), or click “Choose files”. “Try a sample” shows how it works.

  2. Review what will be redacted: cookies, Authorization, secret-like headers, URL queries, request bodies, JWTs. E-mail addresses and phone numbers can be added.

  3. Choose how to treat response bodies: redact secret-looking values only, delete the whole body, or leave them untouched. Replace with [REDACTED] or give the same value the same marker.

  4. Check the redacted counts and the “possibly not redacted” list, then pick a URL in the list to compare the original and the redacted version.

  5. Save the redacted .har. It opens in the Chrome and Firefox HAR viewers. Look through it yourself once before sending it.

What it does

Cookies, auth headers and URLs by type

Cookie and Set-Cookie keep names and attributes (Path, HttpOnly …) and lose only the value. Authorization keeps the scheme (Bearer …). URLs lose the values of token, code, state, session, key, password-like query and fragment parameters, and any user info.

Bodies judged by format

JSON is walked and keys such as password, token and secret are redacted; form bodies lose password fields. HTML password inputs and hidden inputs with CSRF-token-like names are covered too. Base64 bodies are inspected only when they decode to text.

JWTs and key formats reuse the Secret Scanner rules

AWS, GitHub, Slack, Stripe, Google and OpenAI-style keys, JWTs, private keys and DB connection strings are searched for in bodies, headers and URLs regardless of field names.

Tells you what may be left

Places that cannot be judged — image/binary bodies, multipart bodies, WebSocket messages — and long random-looking strings that remain after redaction are listed as warnings.

Large HARs do not freeze the page

Loading and redacting run in a Web Worker with a progress bar and a cancel button. The size limit is 100 MB. The screen shows only the first part of the list; the saved file covers every request with the original structure.

Use cases

  • Remove cookies and tokens before sending a HAR to support or a vendor
  • Hide passwords and personal data before attaching a HAR to an internal incident report or issue
  • Share traffic where the same session ID or token repeats while keeping the correlation
  • See what a HAR file actually contains with the request list and the before/after view

Capability matrix

FeatureSupportNotes
Redacting Cookie, Set-Cookie, cookies arrays and AuthorizationSupported—
URL query, fragment, user info, Referer and LocationSupported—
Secret-looking fields in JSON, form and HTML bodiesSupportedJudged by field name; values whose names give no hint stay
JWTs and known key formatsSupported—
E-mail addresses and phone numbersPartialOptional; phone numbers only with hyphens or spaces
Same value → same marker (keeps correlation)Supported—
Custom token formats and personal data inside prosePartialNot detected unless the name or format gives it away; long random-looking strings are flagged as warnings
Text inside images, PDFs and other binary dataNot supportedNot inspected; listed as a warning
Processing several HAR files at onceNot supportedOne file at a time
A guarantee that every secret is foundNot supported—

Limits & notes

  • This is a helper. It does not guarantee that every secret or piece of personal data is found. Check the warnings and the before/after view, and set response bodies to “Delete” when in doubt.
  • One file at a time, up to 100 MB. A very large file can still run out of browser memory.
  • The request list shows the first 300 and the warnings the first 100 (the saved file covers all). The per-request breakdown holds up to 200 items.
  • Bodies over 1 MB are not checked for long random-looking strings.
  • A token or password that was ever handed to a third party must be revoked or changed at its issuer. Redacting the HAR does not take back what was already shared.

Privacy & safety

The HAR is loaded, processed and saved only inside your browser (a Web Worker). Nothing is sent to or stored on a server, and usage analytics contain only a file-size bucket and counts — never file names or content.

FAQ

What can leak when I share a HAR file?
A HAR records traffic as it is, so it can contain cookies, Authorization headers, tokens in URLs, passwords sent at login and personal data in responses. Sessions have been hijacked using HAR files sent to support, so redacting before sharing is recommended.
How do I create a HAR file?
In Chrome or Edge, record in the Network tab of the developer tools and choose “Save all as HAR with content”. In Firefox, use the gear menu or right-click in the Network tab and choose “Save All As HAR”.
Does the redacted HAR open in the Chrome or Firefox viewer?
Yes. The original structure (log, entries, request, response) is kept; only values are replaced with [REDACTED] or similar markers.
Is it safe to share after this?
It cannot be guaranteed. Values whose names or formats give nothing away, and text inside images or binary data, are not detected. Check the warnings and the before/after view, and delete response bodies to be on the safe side.
Why use “same value → same marker”?
It keeps the relationship when one session ID or token appears in many requests, without showing the value, so whoever investigates can still tell which requests share a session.
Is the HAR uploaded anywhere?
No. Loading, processing and saving all happen in your browser and make no network requests.

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

No upload

curl Converter

Paste “Copy as cURL” from Chrome or Firefox to see the method, URL, headers, cookies and body in tables, then convert to 12 kinds of code. The request is never sent and everything runs in your browser. Authorization and cookies can be hidden before you share.

No uploadBeta

Mail Header Analyzer

Paste Gmail’s “Show original” or the headers of an .eml file to get the delivery route in time order, authentication results and mismatches with the From domain. Everything runs in your browser; no DNS, WHOIS or IP location lookups are made.

No uploadBeta

JSON Studio — Formatter & Validator

Paste JSON to format, minify or validate it instantly. Errors are shown with the exact line, column and cause, and comments or trailing commas can be auto-repaired. Your data never leaves your device.

No upload

C2PA Content Credentials Inspector

If a photo or PDF carries C2PA Content Credentials, this shows the app that made it, who signed it, any record of AI use and the edit history. Missing credentials do not prove the file is not AI-made.

No upload

Crypto Studio — Hash, HMAC, Encryption & Keys

Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.

No upload

Last updated: