HAR File Sanitizer & PII Stripper
Remove cookies, authorization headers, bearer tokens, API keys, passwords, and personal information from HAR files entirely in your browser.
Sanitize your HAR files locally
Remove sensitive data like cookies, authorization headers, and API keys before sharing. Everything runs entirely in your browser. No uploads, no telemetry.
Click or drag .har files here
Supports .har and .json files exports from Chrome, Firefox, or Safari.
About HAR File Sanitizer & PII Stripper
HAR (HTTP Archive) files record every network request your browser makes — including URLs, request/response headers, cookies, and full response bodies. This makes them incredibly valuable for debugging, but also a serious security risk when shared. A single HAR file can contain session cookies, API keys, OAuth tokens, and personal data.
This tool lets you upload a HAR file, automatically scan every request for sensitive information, and selectively redact or remove it before sharing. Everything runs 100% locally in your browser — no uploads, no API calls, no telemetry, and no tracking. It works completely offline.
Designed for developers, QA engineers, and support engineers who need to share network traces safely with colleagues or third-party vendors.
How to Use
Real-World Examples
Masking Authorization Headers
Before sharing a HAR with a vendor's support team, mask all Authorization headers. The tool will replace the token value with '[REDACTED_TOKEN]' while keeping the header name intact so engineers can still see that authentication was being sent.
"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
"Authorization": "Bearer [REDACTED_TOKEN]"
Removing Session Cookies
HAR files capture all cookies sent in every request, including your active session cookie. The tool automatically detects common session cookie names (connect.sid, PHPSESSID, _session, etc.) and allows you to remove or mask their values.
"cookies": [{ "name": "connect.sid", "value": "s%3A8xKx_jL1..." }]"cookies": [{ "name": "connect.sid", "value": "[REDACTED_COOKIE]" }]Stripping API Keys from Query Parameters
API keys embedded in query parameters are frequently captured in HAR files. The PII scanner detects common parameter names like api_key, apikey, token, and secret, flagging them for redaction before you share your trace.
"queryString": [{ "name": "api_key", "value": "sk-live-abc123xyz..." }]"queryString": [{ "name": "api_key", "value": "[REDACTED_API_KEY]" }]Best Practices
- Prefer 'Mask' over 'Remove' when sanitizing. Keeping the header name visible (with a redacted value) tells the person receiving the file that authentication was attempted, which is often useful context for debugging.
- Always keep a local copy of the original unsanitized HAR. After sanitization, verify the issue is still reproducible using the sanitized file before deleting the original.
- Use the Privacy Score indicator. A 100% score means all detected findings have been resolved. Aim for 100% before sharing with any external party.
- Run the tool offline for maximum security. Once the page is loaded, you can disconnect your internet before uploading your HAR file.
- Review the 'All Requests' panel before exporting to verify that no sensitive URL paths or domains remain in the request list that could expose internal infrastructure.
- Use Batch Mode when you need to sanitize multiple HAR files from a testing session at once. Each file is processed independently with its own privacy scan.
Pro Tips
Press Ctrl+K (or Cmd+K on Mac) to open the Command Palette for quick navigation between views and actions without using the mouse.
Use the Advanced Filters in the Request Explorer to quickly isolate requests by domain, status code, method, or content type.
Click the 'Load Example' button on the upload panel to explore all features without needing your own HAR file.
In the Dashboard view, the Network Timeline shows when each request was made relative to the page load, helping you spot slow or sequential calls even in the sanitized output.
Frequently Asked Questions
What is a HAR file?
HAR (HTTP Archive) is a JSON-formatted log file that browsers generate to record all network activity. It captures request URLs, methods, headers, cookies, query parameters, request bodies, response bodies, and timing data. HAR files are widely used for debugging, performance analysis, and sharing network traces with support teams.
Does this tool upload my HAR file anywhere?
No — never. This tool is 100% client-side. Your HAR file is loaded into your browser's memory and all processing (parsing, scanning, redaction) happens locally using JavaScript. Nothing is ever sent to a server. You can verify this by disconnecting your internet before uploading.
Does it work offline?
Yes. Once the page has loaded in your browser, you can completely disconnect from the internet and the tool will continue to function normally. All parsing and sanitization logic is embedded in the page itself.
What types of sensitive data does it detect?
The scanner detects: Authorization headers (Bearer tokens, Basic auth), API keys in headers and query parameters, Session cookies, JWT tokens, OAuth tokens, passwords in form data, email addresses, credit card patterns, phone numbers, and any custom patterns you configure in Settings.
Will the sanitized HAR file still be valid?
Yes. The tool maintains the HAR 1.2 JSON schema throughout. Masking replaces values in-place without removing keys, so the file remains fully parseable by Chrome DevTools, Charles Proxy, and other HAR viewers. The structure is never corrupted.
What is the difference between Mask, Remove, and Replace?
Mask replaces the sensitive value with a placeholder like [REDACTED_TOKEN] while keeping the field present. Remove deletes the entire field from the output. Replace substitutes the value with a custom string you provide. Keep leaves the value unchanged.
Can it handle large HAR files?
Yes. The scanner runs in a Web Worker background thread to avoid freezing your browser tab during large file analysis. Files up to 100MB+ are supported, though processing time scales with the number of entries.
Limitations
- Pattern-based detection has false positives and false negatives — always manually review findings before sharing.
- Response bodies larger than 10MB per entry may be truncated during scanning to maintain browser performance.
- Binary response bodies (images, fonts, PDFs) are not scanned for embedded text content.
- The tool cannot detect domain-specific secrets that don't match common naming conventions without adding a custom pattern in Settings.
Security & Privacy
All processing in this tool runs entirely within your browser using client-side JavaScript and Web Workers. Your HAR file content is never transmitted to ToolMono's servers, never stored in a database, and never logged. The tool does not use cookies, localStorage persistence for your file data, or any analytics SDK. You can use it completely offline after the initial page load. For the highest security posture, disconnect from the internet before uploading any HAR file containing authentication tokens or personal data.