HAR Sanitizer — Redact Secrets Locally

Redact cookies, tokens, passwords and personal data from HAR files before you share them. 100% local — nothing is ever uploaded.

Share a HAR file without sharing your passwords. A HAR file is the network recording that support teams ask for when something breaks. It also contains your session cookies, login tokens, API keys, email addresses, IP addresses, and sometimes passwords in plain text. Send it as-is and you have handed over access to your accounts. HAR Sanitizer removes the secrets first. Everything happens inside your browser: no upload, no server, no account. The extension's security policy blocks its pages from making network requests, so it could not send your data anywhere even if it tried. TWO WAYS TO USE IT 1. Record and sanitize inside DevTools Press F12 and open the HAR Sanitizer tab, next to Network and Console. Reproduce your problem and requests appear already redacted; the raw versions are never stored. When you are done, click "Share-ready ✓". It stops recording, scans the result for leftover secrets, shows a plain-language verdict, and downloads the sanitized file. 2. Sanitize a file you already have Click the toolbar icon, then drag and drop one or many .har files. Download them one by one, or all together as a ZIP. WHAT IT REMOVES • Cookie values, in requests and responses • Authorization headers, API-key headers, and CSRF and session tokens • Secrets in URL query strings and fragments • Passwords and sensitive fields in form and JSON request bodies • Credentials embedded in URLs • JSON web tokens and Bearer or Basic authorization strings • Cloud service and API keys from the most common providers • Private keys • Card numbers, SSN-style numbers, and phone numbers • Email addresses and IP addresses (IPv4 and IPv6) • Account and resource IDs, UUIDs, and cloud resource names • Random-looking strings that may be tokens hiding under ordinary names • Any custom text or regular expression you add CHOOSE HOW MUCH TO REMOVE Start from a preset: a balanced default for sending to support, a strict mode for maximum privacy, a secrets-only mode that leaves everything else readable, and a mode for posting publicly. A three-step slider (Readable, Balanced, Thorough) controls how aggressively the tool guesses at random-looking strings. Readable keeps URLs and IDs intact. Thorough catches more and accepts some over-redaction. KEEP THE FILE USEFUL FOR DEBUGGING • Pick a placeholder style: labelled placeholders, consistent hashes, or a fixed "REDACTED". Matching values get matching placeholders, so the same token can still be followed from request to request. • Keep hostnames visible, or replace them with consistent pseudonyms. • Remove tracker and analytics requests to cut noise and shrink the file. • Drop images, fonts, media, and binary bodies, and remove file uploads. • Shift timestamps and strip browser, server, and connection details. • Limit recording to the hosts you care about. • Optionally pretty-print the output. CORRECT IT IN ONE CLICK Click any value to keep it, or to always redact it, for one site or for every site. Save a profile per site, and the extension suggests starter rules when it recognizes common kinds of traffic. RESTORE ORIGINALS (OPTIONAL) Save an encrypted mapping file, protected by your passphrase (AES-256-GCM), alongside the sanitized file. Later you can put the real values back. Only you hold the passphrase, and the file is never sent anywhere. BUILT FOR TEAMS Export your rules as a file and import them on a colleague's computer so everyone sanitizes the same way. Download a text report of exactly what was redacted, or a compressed .har.gz. PRIVATE BY DESIGN • No accounts, no analytics, no tracking, no remote code • One permission only: storage, to remember your settings • Extension pages are locked down so they cannot make network requests • A built-in "Prove it's local" page lets you check this yourself • Plain, unminified JavaScript you can read AN HONEST NOTE No automatic tool can promise to find every secret, especially ones hiding under innocent names. That is why every export gets a leak check and a clear verdict ("Looks safe to share", "Review before sharing", or "Not safe to share") with the reasons. Please skim the result before you send it. WHO IT IS FOR Developers and QA engineers attaching network recordings to bug reports, support teams collecting logs from customers, security teams sharing findings, and anyone asked to send a HAR file to a vendor or help desk. GET STARTED IN THREE STEPS 1. Open DevTools (F12) on the page with the problem and click the HAR Sanitizer tab. 2. Reproduce the issue; requests are redacted as they arrive. 3. Click "Share-ready ✓" and send the downloaded file. Want to see it work first? Click the toolbar icon and choose "Try a sample HAR". It uses fake secrets, so no file is needed. FAQ Is my HAR file uploaded anywhere? No. It is processed on your device and never sent anywhere. Where is the toolbar button for recording? The toolbar icon opens the file app. The recorder lives in DevTools, as a tab next to Network. Can I get my original values back? Only if you saved the encrypted mapping file and remember its passphrase. It redacted too much, or missed something. What now? Lower or raise the over-redaction slider, or click the value and choose Keep or Always redact.