Skip to content
TextArray1.41.0
100% local

HAR file sanitizer

Strip auth tokens, cookies and secrets from a HAR file before sharing it in a support ticket.

Input
Output
Related tools
Data redactorText cleaning
Cookie parserDeveloper tools
HTTP header parserDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
HAR file sanitizer
A HAR (HTTP Archive) file exported from your browser's DevTools Network tab is one of the most useful things you can attach to a bug report — and one of the easiest ways to leak session cookies, bearer tokens and API keys to a support queue. Paste the exported JSON here and this tool strips or masks the sensitive parts before you share it, so request timing, URLs and status codes stay intact for debugging while the credentials don't.
By default it removes the Authorization, Cookie, Set-Cookie, Proxy-Authorization and X-Api-Key headers from every request and response, and clears any explicit cookie entries too. Turn on masking to catch query-string and form parameters whose name looks like a token, key, secret, password or session value. Two options go further: stripping response bodies entirely, and dropping postData request bodies outright. You choose whether a scrubbed field keeps its header name with a blank value, or disappears completely, and whether the replacement text reads REDACTED or an empty string.
The tool checks that the input actually looks like a HAR file — a JSON document with a log.entries array — and reports a clear error with the exact line and column if the JSON itself is malformed. Switch between an indented, readable layout and a compact single-line one depending on where the result is going. When anything is removed, an optional summary at the end lists what was stripped or masked, so whoever reads the ticket knows the log was sanitized rather than incomplete.
Everything runs locally in your browser — the HAR file, which can easily contain live session tokens, is never uploaded anywhere. When you're done, copy the sanitized JSON, download it as a .txt file, or send it straight into another tool to keep working on it.
FAQ
What exactly counts as a "sensitive" query or form parameter?
Any parameter whose name contains token, key, secret, password or session, matched case-insensitively — for example api_token, X-Api-Key or session_id.
Does it also handle the cookies array, not just the Cookie header?
Yes. HAR files can list cookies separately from headers on both the request and the response; both are cleared whenever header removal is on.
Will the sanitized file still work for debugging timing and status codes?
Yes. Only header values, matched parameters, response bodies and postData are touched — URLs, timings, status codes and the overall request/response structure are left alone unless you turn on body or postData removal.
What if my file isn’t valid JSON or isn’t a HAR file?
You get a specific error either way: a JSON syntax problem points to the exact line and column, and a valid-but-wrong document explains that a log.entries array was expected.
Is my HAR file uploaded anywhere?
No. Sanitizing runs entirely in your browser — a file that may contain live session tokens never leaves your device.