Free HAR Sanitizer

How this tool computes its result

Recursively walks a parsed HAR JSON structure (arrays and objects) and, for any object key whose lowercased name contains a sensitive substring — authorization, cookie, set-cookie, token, apikey/api-key/x-api-key, password, secret, session, or bearer — replaces that key's entire value with the literal string '[REDACTED]', incrementing a redaction counter. As a special case, any key literally named 'url' has its value parsed as a URL, and each query-string parameter whose key OR value matches the same sensitive keyword list is rewritten to '[REDACTED]' in place, with the reconstructed URL string substituted back in.

Worked example

Given a HAR fragment with a header object {"name":"Authorization","value":"Bearer abc123"} and a request url of 'https://api.example.com/login?token=xyz789&user=jane', the 'name' key's value 'Authorization' is not itself redacted (the check runs on key names, not values), but a header keyed literally 'authorization' elsewhere would be. Meanwhile the token=xyz789 query parameter is redacted to token=[REDACTED] because 'token' matches the keyword list, and the redacted-fields counter increments accordingly.

When not to use this tool

The input must be valid JSON parseable by JSON.parse — a malformed or truncated HAR export (a common failure mode when copy-pasting very large HAR files from browser DevTools) fails outright with a generic 'HAR must be valid JSON' message rather than attempting any partial or best-effort sanitization.

Common mistakes

• - Assuming header VALUES are scanned for secret-looking content — the redaction logic only inspects field NAMES (like 'authorization' or 'cookie'); a header named something generic like 'X-Custom' whose value happens to be a real secret is never caught.
• - Pasting only a partial request/response fragment instead of a full HAR log — the sanitizer walks whatever JSON shape it's given without requiring a log.entries structure, but downstream tools expecting a complete HAR file may reject the sanitized fragment.
• - Expecting response bodies to be scanned for embedded secrets — only object keys and URL query parameters are inspected; base64-encoded content or raw response body text is passed through untouched.

Related tools