HAR File Sanitizer & PII Stripper

A HAR file is the JSON record a browser or API client saves when you export a network capture. It is a complete transcript: every request URL, every header, every cookie, and usually every response body. Because it captures whatever your session was authorized to do, an unsanitized HAR routinely contains session cookies, bearer tokens, API keys, and personal data from the pages you visited.

Load the .har file into this tool, click Scan HAR, and review the findings list. Each row shows the location and the rule that matched, with a checkbox to keep it or exclude it. Click Sanitize & Prepare Download, then download the sanitized copy. Cookie names, parameter names, JSON keys, and cookie attributes are preserved so the trace still reads correctly.

No. The file is read by a Web Worker inside your browser tab. Nothing is sent to a server, and matched secret values never leave the worker or appear on the page. The findings list shows structural locations such as log.entries[12].request.headers and a field name, never the value that matched.

Yes. There are three presets and each rule can be toggled individually. Sensitive-field rules run on JSON property names, and value-shape rules run on content. Broad rules such as OAuth code parameters, national ID fields, and address fields ship disabled or carry a caution note because they can match ordinary data. Disable a rule when your trace depends on that value being readable.

Yes. Redaction replaces values in place and keeps the original JSON structure, key order, property spelling, and detected indentation. The result is a valid HAR 1.2 file. Binary bodies such as images and fonts are never decoded or rewritten, so those entries are byte-identical to your original.

Bodies are inspected only when their content type is JSON, form-encoded, or text. Images, fonts, archives, and other binary payloads are reported as unsupported and copied through unchanged. A body that declares JSON but does not parse is scanned with value-shape rules only, and those findings are marked partial. The scan summary lists every one of these cases.

Use the verification pass. After redaction the tool rescans its own output with every rule enabled. Name-based rules will still match because names are kept on purpose, so the tool reports only value-shape matches as remaining problems. If nothing remains, loading the downloaded file again and running a scan with all rules enabled should report no matches.

Up to 25 MB and 5,000 entries. Individual bodies over 2 MB are reported as unsupported instead of being decoded, which keeps scanning predictable on long captures. Exports must follow the HAR 1.2 log format: files without a log.entries array, or with a malformed request or response, are rejected rather than partially cleaned.

The name address is too broad to trust. In web traces it just as often refers to a blockchain wallet, a MAC address, or an internal mail routing address rather than a postal location. It ships disabled with a caution note. The same reasoning applies to the US social security number rule, which is shaped for one country's convention.

Not necessarily, and the tool does not claim it will be. Redaction replaces long secrets with a short placeholder, which usually shrinks the file, but the tool re-serializes the document to apply changes, so whitespace and file size can move either way. Compare the byte counts in the summary rather than assuming a reduction.