Online HAR File Sanitizer & Sensitive Data Redactor
Sanitize HAR files online by redacting cookies, Authorization headers, Bearer tokens, and other sensitive data directly in your browser.
Sanitize your HAR files locally
Remove sensitive data like cookies, authorization headers, and API keys before sharing. Everything runs entirely in your browser. No uploads, no telemetry.
Click or drag .har files here
Supports .har and .json files exports from Chrome, Firefox, or Safari.
Overview
The ToolMono HAR File Sanitizer & Sensitive Data Redactor is a security utility designed for software engineers, QA teams, cybersecurity analysts, and technical support specialists. When troubleshooting web application bugs, API failures, or network performance bottlenecks, engineers frequently record and share HTTP Archive (HAR) log files generated by browser Developer Tools.
However, raw HAR files contain complete records of every HTTP request and response — including active session cookies, OAuth 2.0 access and refresh tokens, Bearer tokens, HTTP Basic Authentication credentials, API keys, passwords, and personal information. Sharing an un-sanitized HAR file with a vendor or support channel poses a severe security risk. ToolMono solves this by providing 100% client-side HAR sanitization inside your browser sandbox. For complementary developer workflows, explore our JWT Decoder, JSON Formatter, URL Parser, Hash Generator, and Base64 Encoder/Decoder.
How to Sanitize a HAR File Online
Export a .har network trace from Chrome, Edge, Firefox, or Safari, then drop it into the upload zone or click Load Sample HAR.
ToolMono automatically scans HTTP entries for session cookies, Authorization headers, Bearer tokens, JWTs, API keys, passwords, and custom rules.
Compare original vs. sanitized HAR in the Side-by-Side Diff Viewer, then download your sanitized HAR file or privacy report.
Why HAR Files Contain Sensitive Data
When you record a HAR file in browser Developer Tools, the browser logs every HTTP request and response header exactly as sent over the network. This includes session identifiers, bearer tokens, passwords, and authentication cookies. Sharing a raw HAR file is functionally equivalent to giving someone your active login session!
Contains OAuth 2.0 Bearer tokens, JWT signatures, and HTTP Basic base64 passwords used to authenticate API calls.
Captures connect.sid, PHPSESSID, JSESSIONID, and Set-Cookie instructions that allow session hijacking.
Captures raw JSON payloads, POST form body fields (password, secret), and query parameters (api_key).
Sensitive Data Reference Table
The table below outlines standard HTTP headers, cookies, tokens, and credentials automatically detected and sanitized by ToolMono:
| Field / Header Name | Risk Level | Auto Action | Security Reason & Impact |
|---|---|---|---|
| Authorization | CRITICAL | Mask / Redact | Contains Bearer JWTs, OAuth tokens, or Basic Auth credentials. |
| Cookie | CRITICAL | Mask / Strip | Contains active browser session tokens and authentication cookies. |
| Set-Cookie | CRITICAL | Mask Values | Response header issuing new session identifiers to the client. |
| JWT Signature | CRITICAL | Redact Signature | Prevents token reuse while preserving header/payload structure. |
| X-API-Key / X-Auth-Token | HIGH | Mask Value | Custom API authentication headers used in microservices. |
| password / secret / token | HIGH | Redact Body Field | Form fields or JSON body parameters containing user credentials. |
| Proxy-Authorization | HIGH | Mask Value | Corporate proxy gateway authentication credentials. |
| api_key / access_token (Query) | MEDIUM | Mask Parameter | Query parameters containing secret keys in GET requests. |
How to Export HAR Files from Your Browser
Follow these step-by-step instructions to record and export network HAR traces from your web browser:
- Open Chrome and press F12 (or Cmd+Option+I on Mac) to open DevTools.
- Select the Network tab.
- Check the Preserve log checkbox at the top bar.
- Reproduce the issue or API request in your browser tab.
- Click the Export HAR icon (downward arrow) or right-click any request and select Save all as HAR with content.
- Drop the saved
.harfile into ToolMono HAR File Sanitizer.
How to Parse and Sanitize HAR Files
Integrate automated HAR file sanitization into your CI/CD pipelines, support scripts, or CLI utilities using these implementation examples across popular programming languages:
// Client-side HAR Sanitization using Native JavaScript
async function sanitizeHarFile(file) {
const text = await file.text();
const har = JSON.parse(text);
const SENSITIVE_HEADERS = ['authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token'];
const JWT_REGEX = /eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+/g;
if (har.log && har.log.entries) {
har.log.entries.forEach(entry => {
// 1. Sanitize Request Headers
if (entry.request.headers) {
entry.request.headers.forEach(h => {
if (SENSITIVE_HEADERS.includes(h.name.toLowerCase())) {
h.value = '[REDACTED_HEADER]';
}
});
}
// 2. Sanitize Cookies
if (entry.request.cookies) {
entry.request.cookies.forEach(c => {
c.value = '[REDACTED_COOKIE]';
});
}
// 3. Sanitize Response Headers
if (entry.response && entry.response.headers) {
entry.response.headers.forEach(h => {
if (SENSITIVE_HEADERS.includes(h.name.toLowerCase())) {
h.value = '[REDACTED_HEADER]';
}
});
}
});
}
return JSON.stringify(har, null, 2);
}const fs = require('fs');
function sanitizeHar(inputPath, outputPath) {
const rawData = fs.readFileSync(inputPath, 'utf-8');
const har = JSON.parse(rawData);
const redactPatterns = [
{ regex: /"name":\s*"(authorization|cookie|set-cookie|x-api-key)"/gi, replace: '"name":"$1","value":"[REDACTED]"' },
{ regex: /eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+/g, replace: '[REDACTED_JWT]' }
];
let jsonStr = JSON.stringify(har);
redactPatterns.forEach(p => {
jsonStr = jsonStr.replace(p.regex, p.replace);
});
fs.writeFileSync(outputPath, jsonStr, 'utf-8');
console.log("HAR file sanitized successfully:", outputPath);
}
sanitizeHar('debug.har', 'sanitized.har');import json
import re
def sanitize_har(input_file, output_file):
with open(input_file, 'r', encoding='utf-8') as f:
har = json.load(f)
sensitive_keys = {'authorization', 'cookie', 'set-cookie', 'x-api-key', 'session', 'token'}
for entry in har.get('log', {}).get('entries', []):
# Sanitize Headers
for header in entry.get('request', {}).get('headers', []):
if header.get('name', '').lower() in sensitive_keys:
header['value'] = '[REDACTED_HEADER]'
# Sanitize Cookies
for cookie in entry.get('request', {}).get('cookies', []):
cookie['value'] = '[REDACTED_COOKIE]'
with open(output_file, 'w', encoding='utf-8') as f:
json.dump(har, f, indent=2)
print(f"Sanitized HAR written to {output_file}")
sanitize_har("network.har", "clean_network.har")package main
import (
"encoding/json"
"fmt"
"os"
"strings"
)
type HAR struct {
Log struct {
Entries []struct {
Request struct {
Headers []struct {
Name string `json:"name"`
Value string `json:"value"`
} `json:"headers"`
} `json:"request"`
} `json:"entries"`
} `json:"log"`
}
func main() {
data, _ := os.ReadFile("input.har")
var har HAR
json.Unmarshal(data, &har)
for i := range har.Log.Entries {
for j := range har.Log.Entries[i].Request.Headers {
name := strings.ToLower(har.Log.Entries[i].Request.Headers[j].Name)
if name == "authorization" || name == "cookie" {
har.Log.Entries[i].Request.Headers[j].Value = "[REDACTED]"
}
}
}
cleanData, _ := json.MarshalIndent(har, "", " ")
os.WriteFile("sanitized.har", cleanData, 0644)
fmt.Println("HAR file sanitized in Go!")
}# PowerShell HAR File Sanitization Script
$har = Get-Content -Path "C:\Logs\trace.har" -Raw | ConvertFrom-Json
foreach ($entry in $har.log.entries) {
foreach ($header in $entry.request.headers) {
if ($header.name -match "Authorization|Cookie|X-API-Key") {
$header.value = "[REDACTED_HEADER]"
}
}
}
$har | ConvertTo-Json -Depth 100 | Set-Content -Path "C:\Logs\sanitized.har"
Write-Host "HAR Sanitization Complete!" -ForegroundColor GreenSecurity & Privacy Rules
At ToolMono, privacy is a foundational architectural guarantee. All HAR file parsing, JSON manipulation, security risk scanning, PII redaction, and file generation execute entirely inside your browser's local JavaScript runtime.
Your HAR file data is never sent to any remote server, database, or analytics platform. Once the web app is loaded in your browser, you can disconnect your internet connection and sanitize files 100% offline.
Manual Review Guidance
Automated rules target known sensitive patterns (Authorization headers, Cookies, JWTs), but custom application secrets may appear in unexpected headers, query parameters, or POST request bodies.
Search your sanitized HAR file for terms like:
- Authorization
- Cookie
- Set-Cookie
- access_token
- api_key
- password
Frequently Asked Questions
References & Standards
W3C Web Performance Working Group: HAR 1.2 Specification
Official specification for HTTP Archive format structure.
RFC 9110: HTTP Semantics Specification
Official IETF standard for HTTP request/response headers and authentication.
OWASP Transport Layer Protection Cheat Sheet
Official security guidelines for redacting sensitive credentials and tokens.
Related Tools
Browse all toolsJWT Decoder Online
Decode JWT tokens instantly in your browser. Inspect headers, payload claims, verify signatures, convert timestamps, and debug JWTs securely with 100% client-side processing.
JSON Formatter
Free online JSON formatter, beautifier, and validator. Format, indent, minify, and inspect JSON with real-time syntax error detection in your browser. 100% client-side.
Online URL Parser & Parameter Extractor
Instantly parse any URL online. Extract scheme, hostname, path, query parameters, and fragments directly in your browser with 100% client-side privacy.
Hash Generator
Generate hashes and file checksums locally in your browser. Compare digests, copy results, and use MD5, SHA-1, SHA-2, SHA-3, BLAKE2, and supported HMAC algorithms.
URL Encoder & Decoder
Free, 100% client-side URL encoder and decoder. Convert text and query parameters into RFC 3986 percent-encoded strings or decode URLs with smart double-encoding detection and structural URL analysis.
Base64 Encoder Decoder
Free, 100% client-side Base64 encoder and decoder. Convert text, strings, and data to Base64 or Base64URL instantly with UTF-8 support, padding controls, and client-side processing.