# HAR Redactor Replace HAR cookies, auth headers, query tokens, and bodies with a placeholder while keeping the capture valid and viewer-friendly. ## Run it - **CLI:** `gizza tool har-redact '{"log":{"entries":[{"request":{"method":"POST","url":"https://example.com/api/login?token=SECRET123","headers":[{"name":"Authorization","value":"Bearer eyJhbGc.payload.sig"}],"cookies":[{"name":"sessionid","value":"topsecretsession"}]},"response":{"status":200,"content":{"size":24,"mimeType":"application/json","text":"{\"session\":\"privatetok\"}"}}}]}}'` - **Web:** https://gizza.ai/tools/har-redact/ - **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/har-redact/tool.json ## Inputs - `har` — HAR file (JSON) _(field)_ - `cookies` — Redact cookies _(field)_ - `auth_headers` — Redact auth / API-key headers _(field)_ - `extra_headers` — Extra header names (optional) _(field)_ - `query_params` — Redact sensitive query params _(field)_ - `sensitive_params` — Extra param names (optional) _(field)_ - `bodies` — Redact bodies _(field)_ - `placeholder` — Placeholder text _(field)_ - `output` — Output _(field)_ - `pretty` — Pretty-print output _(field)_ ## Output - Redacted HAR / summary (text) ## Query parameters Open the tool pre-filled and auto-run via URL: - `har` — HAR file (JSON) - `cookies` — Redact cookies - `auth_headers` — Redact auth / API-key headers - `extra_headers` — Extra header names (optional) - `query_params` — Redact sensitive query params - `sensitive_params` — Extra param names (optional) - `bodies` — Redact bodies - `placeholder` — Placeholder text - `output` — Output - `pretty` — Pretty-print output Example: `https://gizza.ai/tools/har-redact/?har=%7B%22log%22%3A%7B%22entries%22%3A%5B%7B%22request%22%3A%7B%22method%22%3A%22POST%22%2C%22url%22%3A%22https%3A%2F%2Fexample.com%2Fapi%2Flogin%3Ftoken%3DSECRET123%22%2C%22headers%22%3A%5B%7B%22name%22%3A%22Authorization%22%2C%22value%22%3A%22Bearer%20eyJhbGc.payload.sig%22%7D%5D%2C%22cookies%22%3A%5B%7B%22name%22%3A%22sessionid%22%2C%22value%22%3A%22topsecretsession%22%7D%5D%7D%2C%22response%22%3A%7B%22status%22%3A200%2C%22content%22%3A%7B%22size%22%3A24%2C%22mimeType%22%3A%22application%2Fjson%22%2C%22text%22%3A%22%7B%5C%22session%5C%22%3A%5C%22privatetok%5C%22%7D%22%7D%7D%7D%5D%7D%7D&cookies=true&auth_headers=true&extra_headers=x-tenant-id%2Cx-trace&query_params=true&sensitive_params=account_id%2Ctenant&bodies=response&placeholder=%5BREDACTED%5D&output=har&pretty=true` --- ## Share HAR captures without leaking session secrets Browser HAR files are useful for debugging failed requests because they preserve URLs, methods, status codes, timings, headers, cookies, and response metadata. They can also contain live session cookies, bearer tokens, API keys, OAuth codes, and copied response bodies. Paste a HAR here to replace those sensitive **values** with a placeholder while keeping the capture's shape intact, so the redacted file still opens in HAR viewers and remains useful for support or bug reports. ### Worked example Paste a HAR exported from DevTools after reproducing a login issue. Leave the default options on to redact cookie values, Authorization/API-key headers, sensitive query parameters such as `token` or `client_secret`, and response bodies. The output keeps request URLs, paths, status codes, timings, and header names, but turns secrets such as cookie strings, bearer tokens, and `?token=...` values into `[REDACTED]`. Choose **Summary** first if you want a dry-run count before copying the sanitized HAR. ### What is redacted - Request and response `cookies[].value`, plus `Cookie` and `Set-Cookie` header values. - Authorization, Proxy-Authorization, and common API-key/token header values. - Sensitive query-string parameter values in both `request.queryString[]` and `request.url`. - Response bodies by default; request bodies too when **Redact bodies** is set to `Both` or `Request bodies only`. - Extra header names or parameter names you provide as comma-separated lists. ### Limits and edge cases The input must be a JSON HAR object with `log.entries`. Up to 10,000 entries are processed per run. Values are substituted in place rather than removed, so the output remains valid JSON/HAR; however, no automated redactor can know every private field name in a custom API. Add project-specific header or parameter names when your capture contains organization-specific secrets. ## FAQ
Does this remove requests from the HAR? No. It keeps the waterfall structure, request and response objects, URLs, timings, status codes, and names of headers/cookies/parameters. Only selected sensitive values are replaced with the placeholder.
Should I redact request bodies too? If a request body can contain passwords, form fields, tokens, or customer data, choose `Both` or `Request bodies only`. The default redacts response bodies because API responses commonly echo session data, while preserving request bodies unless you opt in.
Can I add my own secret field names? Yes. Use **Extra header names** for headers such as `x-tenant-secret`, and **Extra param names** for query or form parameter names such as `account_id` or `tenant`. Names are matched case-insensitively.
Is this a guarantee that the HAR is safe to publish publicly? No automated redactor can guarantee that. Review the output before publishing, especially URLs, path segments, custom headers, and JSON bodies you chose not to redact. This tool is meant to reduce common HAR leaks before private sharing and review.
## Related tools - [HAR Body Stripper](https://gizza.ai/tools/har-body-stripper/): Remove request and response bodies from a HAR capture to shrink it and clear payloads before sharing. Filter by side, mimeType, or size — all in your browser. - [Basic Auth Header Generator](https://gizza.ai/tools/basic-auth-header-generator/): Generate an HTTP Basic Authorization header from a username and password — base64(user:pass) per RFC 7617. Runs in your browser, nothing is sent, free. - [CIDR Calculator](https://gizza.ai/tools/cidr-calculator/): CIDR calculator: get network address, broadcast, netmask, wildcard, usable host range and host count for any IPv4 or IPv6 prefix. Free, private, in-browser. - [cURL Command Parser](https://gizza.ai/tools/curl-command-parser/): Paste a curl command to see its method, URL, query params, headers, body, auth, cookies and flags — or rebuild clean curl. Browser-only. - [Disposable Email Detector](https://gizza.ai/tools/disposable-email-detector/): Check if an email address or domain is a disposable or throwaway inbox (Mailinator, Guerrilla Mail, YOPmail and more) — free, private, right in your browser.