HAR, sanitized locally

Strip the secrets from a HAR file, without uploading it.

A HAR is a full recording of your browser traffic. It leaks cookies, auth tokens, and session data. Drop one here and every secret gets replaced with [REDACTED] in your tab, then download the clean HAR. Nothing is ever sent.

nothing leaves your tab. open the network tab and watch.

Try it, live in your browser

How it works

1. Drop or paste

   Give it a .har file from your browser's network tab, by drag and drop, file picker, or paste. It never leaves the page.

2. Redact in the tab

   Pure TypeScript parses the JSON and swaps sensitive values for [REDACTED], keeping key names and structure so the file still validates as a HAR.

3. Read the summary, download clean

   A green band tells you how many secrets came out across how many requests, itemized by category. Then download the sanitized HAR.

What it removes

• Auth headersAuthorization, Proxy-Authorization, Cookie, Set-Cookie, X-Api-Key, X-Auth-Token, and any header named for a token, secret, apikey, auth, session, or password.
• CookiesThe value of every cookie in request.cookies and response.cookies. The names stay, so you keep the shape.
• URL tokensQuery params like access_token, id_token, refresh_token, code, sig, signature, key, and sid, in both queryString and the url.
• Body tokensJWTs and Bearer tokens anywhere in a body, plus sensitive keys inside JSON and form-encoded payloads.
• PII, optionalEmails and IPv4 addresses in headers, query, and bodies. Off by default because it is noisy, one toggle to turn on.

Why HAR sanitizer

• Provably localAll redaction is TypeScript running in your tab. Open the network panel: dropping a HAR makes zero requests.
• Keeps it validOnly values are replaced. Key names and the log.entries structure stay intact, so the clean HAR still opens in any HAR viewer.
• Covers the leaksAuth headers, cookies, URL tokens, JWTs and Bearer tokens in bodies, and optionally emails and IPs.
• No account, no uploadA single static page. Nothing to sign up for, nothing to leak. Share a HAR for a bug report without leaking your session.

Part of Sealed

Sealed is a small suite of provably-local developer tools: the work happens in your browser, and the whole promise is that your data never leaves it.

sealedtools.pages.dev →