01
Choose a HAR file
Open one HAR or JSON network capture up to 20 MB, or paste readable HAR JSON.
Privacy & Security Tools
HAR Privacy Sanitizer
Remove supported secrets from HAR headers, URL parameters, JSON, and form bodies without silently changing unknown body formats.
Loading this local tool…
Data handling
Storage and export controls
- Retention
- The tool's working state is kept only while this page is open. Inputs and results are not saved to persistent storage by Got A Tool.
- Export
- The tool may prepare a result after you run it. It downloads or copies it only when you choose that action.
Advertising and analytics are separate site services. We do not send selected tool input to them. Read the Privacy Policy for details.
How it works
Prepare a HAR file for sharing in three steps.
02
Review changes and exceptions
Check each supported header, cookie, parameter, JSON field, or form field the tool plans to redact. Read every entry that needs review.
03
Download a separate copy
Save the sanitized HAR after reviewing it. The original capture is never modified.
Supported scope
Change known sensitive fields, not the rest of the capture.
The supported fields
The tool redacts request and response cookie lists, supported headers, URL parameters, JSON body fields, and URL-encoded form fields for documented secret names.
What stays for review
Unknown request-body formats, non-JSON response bodies, unreadable entries, and fields outside the documented rules stay unchanged and appear in the review list when detected.
Other sharing workflows
Use a tool that matches the content you are reviewing.
Config files and logs
Secret Scanner & RedactorPersonal details in an AI prompt
AI Prompt PII Sanitizer.env variable names and templates
.env Semantic DiffWill it redact every secret in a HAR file?
No. It changes only a narrow, documented set of sensitive headers, cookie values, and field names. A clean result is not proof that the capture is safe to share.
Which identifiers are left unchanged?
Fields such as trace_id, request_id, and account_id are not redacted by this tool. Review the downloaded copy before sharing it.
Are unsupported request bodies removed?
No. Unsupported body formats stay unchanged. The result lists them so you can make a separate decision instead of losing data silently.
Is my HAR file uploaded?
No. Reading, review, sanitizing, and download happen in your browser.
Example
A supported secret is replaced; diagnostic IDs stay visible for review.
A request header named Authorization is within the documented rule set, so its value becomes a fixed redaction marker. A trace_id is deliberately left alone: it can be useful for support, but you should still decide whether it is appropriate to share.
Before review
Authorization: Bearer private-token trace_id: request-42
After sanitizing
Authorization: [REDACTED] trace_id: request-42
Practical guide
Read the AI sharing preparation guide
Decide which details belong in a shareable copy, avoid asking a tool to guess, and inspect the result before you paste it elsewhere.
Open the guide →Keep working
Related tools
Secret Scanner & Redactor
Find known API keys, tokens, webhooks, database passwords, and Bearer headers before sharing text.
Open tool →AI Prompt PII Sanitizer
Mask deterministic sensitive details before sharing text with an AI, then restore exact tokens locally.
Open tool →.env Semantic Diff
Compare .env files by key, find missing variables, flag simple syntax issues, and create a safe empty-value template locally.
Open tool →