HAR Redactor

Paste a HAR capture and replace its secrets — cookies, Authorization and API-key headers, query-string tokens, and bodies — with a placeholder, while URLs, methods, status codes, timings, and sizes stay intact so the capture still opens in any viewer. Choose what to redact and get the sanitized HAR or a dry-run summary. Runs in your browser; nothing is uploaded.

Share HAR captures without leaking session secrets

Browser HAR files are useful for debugging failed requests because they preserve URLs, methods, status codes, timings, headers, cookies, and response metadata. They can also contain live session cookies, bearer tokens, API keys, OAuth codes, and copied response bodies. Paste a HAR here to replace those sensitive values with a placeholder while keeping the capture's shape intact, so the redacted file still opens in HAR viewers and remains useful for support or bug reports.

Worked example

Paste a HAR exported from DevTools after reproducing a login issue. Leave the default options on to redact cookie values, Authorization/API-key headers, sensitive query parameters such as token or client_secret, and response bodies. The output keeps request URLs, paths, status codes, timings, and header names, but turns secrets such as cookie strings, bearer tokens, and ?token=... values into [REDACTED]. Choose Summary first if you want a dry-run count before copying the sanitized HAR.

What is redacted

Request and response cookies[].value, plus Cookie and Set-Cookie header values.
Authorization, Proxy-Authorization, and common API-key/token header values.
Sensitive query-string parameter values in both request.queryString[] and request.url.
Response bodies by default; request bodies too when Redact bodies is set to Both or Request bodies only.
Extra header names or parameter names you provide as comma-separated lists.

Limits and edge cases

The input must be a JSON HAR object with log.entries. Up to 10,000 entries are processed per run. Values are substituted in place rather than removed, so the output remains valid JSON/HAR; however, no automated redactor can know every private field name in a custom API. Add project-specific header or parameter names when your capture contains organization-specific secrets.

FAQ

Does this remove requests from the HAR?

No. It keeps the waterfall structure, request and response objects, URLs, timings, status codes, and names of headers/cookies/parameters. Only selected sensitive values are replaced with the placeholder.

Should I redact request bodies too?

If a request body can contain passwords, form fields, tokens, or customer data, choose Both or Request bodies only. The default redacts response bodies because API responses commonly echo session data, while preserving request bodies unless you opt in.

Can I add my own secret field names?

Yes. Use Extra header names for headers such as x-tenant-secret, and Extra param names for query or form parameter names such as account_id or tenant. Names are matched case-insensitively.

Is this a guarantee that the HAR is safe to publish publicly?

No automated redactor can guarantee that. Review the output before publishing, especially URLs, path segments, custom headers, and JSON bodies you chose not to redact. This tool is meant to reduce common HAR leaks before private sharing and review.

Developer & Automation Access

Run it from the terminal

Same engine as this page, headless — via the gizza CLI:

gizza tool har-redact '{"log":{"entries":[{"request":{"method":"POST","url":"https://example.com/api/login?token=SECRET123","headers":[{"name":"Authorization","value":"Bearer eyJhbGc.payload.sig"}],"cookies":[{"name":"sessionid","value":"topsecretsession"}]},"response":{"status":200,"content":{"size":24,"mimeType":"application/json","text":"{\"session\":\"privatetok\"}"}}}]}}'

New to the CLI? Get gizza →

Open it by URL

Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:

https://gizza.ai/tools/har-redact/?har=%7B%22log%22%3A%7B%22entries%22%3A%5B%7B%22request%22%3A%7B%22method%22%3A%22POST%22%2C%22url%22%3A%22https%3A%2F%2Fexample.com%2Fapi%2Flogin%3Ftoken%3DSECRET123%22%2C%22headers%22%3A%5B%7B%22name%22%3A%22Authorization%22%2C%22value%22%3A%22Bearer%20eyJhbGc.payload.sig%22%7D%5D%2C%22cookies%22%3A%5B%7B%22name%22%3A%22sessionid%22%2C%22value%22%3A%22topsecretsession%22%7D%5D%7D%2C%22response%22%3A%7B%22status%22%3A200%2C%22content%22%3A%7B%22size%22%3A24%2C%22mimeType%22%3A%22application%2Fjson%22%2C%22text%22%3A%22%7B%5C%22session%5C%22%3A%5C%22privatetok%5C%22%7D%22%7D%7D%7D%5D%7D%7D&cookies=true&auth_headers=true&extra_headers=x-tenant-id%2Cx-trace&query_params=true&sensitive_params=account_id%2Ctenant&bodies=response&placeholder=%5BREDACTED%5D&output=har&pretty=true

Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.