FREE TOOLS
HAR Sensitive Data Redactor
Redact explicitly selected HAR fields and supported bodies with a complete audit.
Optional UTF-8 source file (overrides text), Source JSON, Sensitive names,comma-separated, Unsupported body policy
HAR, JSON
Browser only
Runs locally in your browser. Your files, pasted content and generated output are not uploaded. Reset clears this tool’s working data.
This tool needs JavaScript. If it does not load, refresh the page and try again.
How to use this tool
- Enter the displayed example values,or choose the local input files requested by the controls. Optional source files take precedence where labelled.
- Choose Redact defined fields and inspect the complete result and any reported limitations.
- Use Download result and each companion download link to save complete outputs. Reset clears output and restores example controls.
Examples
Source JSON: {
"log": {
"version": "1.2",
"creator": {
"name": "Local sample",
"version": "1"
},
"entries": [
{
"startedDateTime": "2026-10-23T10:00:00Z",
"time": 10,
"request": {
"method": "GET",
"url": "https://example.invalid/api?token=example",
"httpVersion": "HTTP/1.1",
"headers": [],
"queryString": [
{
"name": "token",
"value": "example"
}
],
"cookies": [],
"headersSize": -1,
"bodySize": 0
},
"response": {
"status": 200,
"statusText": "OK",
"httpVersion": "HTTP/1.1",
"headers": [
{
"name": "Content-Type",
"value": "application/json"
}
],
"cookies": [],
"content": {
"size": 11,
"mimeType": "application/json",
"text": "{\"ok\":true}"
},
"redirectURL": "",
"headersSize": -1,
"bodySize": 11
},
"cache": {},
"timings": {
"send": 1,
"wait": 8,
"receive": 1
}
}
]
}
}
Sensitive names,comma-separated: authorization,cookie,set-cookie,x-api-key,token,access_token,password,secret,api_key
Unsupported body policy: refuse
Limitations
- Redact selected case-insensitive ASCII names in HAR1.2 request/response headers,query arrays,URL queries,postData params and nested JSON/form bodies. Redact all HAR cookie values and remove URL userinfo. Preserve duplicate query/form cardinality,source unknown fields and exact untouched body text. JSON/form or standard Base64 UTF8 bodies supported;strict default refuses unsupported/malformed bodies,explicit retain-and-report keeps them with warnings. No removed value appears in the audit. Changed URL/form/JSON may canonicalize;changed transfer sizes become−1 and stale Content-Length/compression are removed. Other PII,paths,comments,extensions and explicitly retained bodies can remain sensitive;not universal anonymization.1–100names,1,000entries/1,000rows per header/cookie/query list. One strict UTF-8 JSON source up to1 MiB,40levels/100,000values. Complete artifacts only;combined downloads≤32 MiB,each JSON≤20 MiB,audit≤10 MiB. No request,script,authentication,file or external resource is executed;all processing stays in your browser.
- Complete outputs only. Unsupported or oversized input is refused. Follow the displayed job-specific bounds and format policies.