tamper[box]

HAR File Sanitizer

Redact Before You Share

Sharing a HAR file? Replace credentials and personal values, then inspect the failed requests before attaching it.

Remove passwords, tokens, cookies, API keys, emails and card numbers from a HAR file in your browser, keep JWT claims, and list failed requests for a ticket. Jump to: Break it.

Example A sign-in, an order list and a failed checkout on a sample shop. Replace it with your own HAR file on the left.

8 values replaced in 3 requests. Review before sharing.

Each value has one placeholder throughout the file (19 replacements in all), so a session or user can still be followed. Replacement is by field name and known patterns: check any free-text field that could hold a name or address.

Your HAR file stays in your browser. It is read and cleaned here and never uploaded, including files you open or drop.

Nothing is sent or stored. No server request is made for any input.

What was replaced

8 distinct values, 19 replacements
Request 1email-1@redacted.invalidEmail addresses, request body.email
Request 1[PASSWORD_1]Credentials and tokens, request body.password
Request 1[COOKIE_1]Cookie values, response header set-cookie
Request 1[COOKIE_1]Cookie values, response cookie session
Request 1email-1@redacted.invalidEmail addresses, response body.access_token.email
Request 1eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQ4MjEiLCJlbWFpbCI6ImVtYWl…JSON Web Tokens, response body.access_token
Request 1[TOKEN_1]Credentials and tokens, response body.refresh_token
Request 2[TOKEN_2]Credentials and tokens, request api_key
Request 2email-1@redacted.invalidEmail addresses, request header authorization.email
Request 2eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQ4MjEiLCJlbWFpbCI6ImVtYWl…JSON Web Tokens, request header authorization
Request 2[COOKIE_1]Cookie values, request header cookie
Request 2[COOKIE_2]Cookie values, request header cookie
Request 2[COOKIE_1]Cookie values, request cookie session
Request 2[COOKIE_2]Cookie values, request cookie theme
Request 2[TOKEN_2]Credentials and tokens, request query api_key
Request 2email-1@redacted.invalidEmail addresses, response body.orders.contact
Request 3email-1@redacted.invalidEmail addresses, request header authorization.email
Request 3eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQ4MjEiLCJlbWFpbCI6ImVtYWl…JSON Web Tokens, request header authorization
Request 3[CARD_1]Card numbers, request body.card

Original values are never shown or copied.

Sanitized HAR

Show the sanitized HAR 
{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "Example browser",
      "version": "1.0"
    },
    "pages": [
      {
        "startedDateTime": "2026-10-24T09:15:02.120Z",
        "id": "page_1",
        "title": "https://app.harbor-supply.example/orders",
        "pageTimings": {
          "onContentLoad": 420,
          "onLoad": 610
        }
      }
    ],
    "entries": [
      {
        "pageref": "page_1",
        "startedDateTime": "2026-10-24T09:15:02.120Z",
        "time": 182,
        "request": {
          "method": "POST",
          "url": "https://app.harbor-supply.example/api/login",
          "httpVersion": "HTTP/2",
          "headers": [
            {
              "name": "content-type",
              "value": "application/json"
            },
            {
              "name": "origin",
              "value": "https://app.harbor-supply.example"
            }
          ],
          "cookies": [],
          "queryString": [],
          "headersSize": -1,
          "bodySize": 70,
          "postData": {
            "mimeType": "application/json",
            "text": "{\"email\":\"email-1@redacted.invalid\",\"password\":\"[PASSWORD_1]\"}"
          }
        },
        "response": {
          "status": 200,
          "statusText": "OK",
          "httpVersion": "HTTP/2",
          "headers": [
            {
              "name": "content-type",
              "value": "application/json"
            },
            {
              "name": "set-cookie",
              "value": "session=[COOKIE_1]; Path=/; Secure; HttpOnly; SameSite=Lax"
            }
          ],
          "cookies": [
            {
              "name": "session",
              "value": "[COOKIE_1]",
              "path": "/",
              "httpOnly": true,
              "secure": true
            }
          ],
          "content": {
            "size": 410,
            "mimeType": "application/json",
            "text": "{\"access_token\":\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQ4MjEiLCJlbWFpbCI6ImVtYWlsLTFAcmVkYWN0ZWQuaW52YWxpZCIsImV4cCI6MTg5MzQ1NjAwMH0.redacted-signature\",\"refresh_token\":\"[TOKEN_1]\",\"token_type\":\"Bearer\",\"expires_in\":3600}"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": 410
        },
        "cache": {},
        "timings": {
          "send": 1,
          "wait": 170,
          "receive": 11
        }
      },
      {
        "pageref": "page_1",
        "startedDateTime": "2026-10-24T09:15:02.410Z",
        "time": 96,
        "request": {
          "method": "GET",
          "url": "https://app.harbor-supply.example/api/orders?status=open&api_key=%5BTOKEN_2%5D",
          "httpVersion": "HTTP/2",
          "headers": [
            {
              "name": "authorization",
              "value": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQ4MjEiLCJlbWFpbCI6ImVtYWlsLTFAcmVkYWN0ZWQuaW52YWxpZCIsImV4cCI6MTg5MzQ1NjAwMH0.redacted-signature"
            },
            {
              "name": "cookie",
              "value": "session=[COOKIE_1]; theme=[COOKIE_2]"
            }
          ],
          "cookies": [
            {
              "name": "session",
              "value": "[COOKIE_1]"
            },
            {
              "name": "theme",
              "value": "[COOKIE_2]"
            }
          ],
          "queryString": [
            {
              "name": "status",
              "value": "open"
            },
            {
              "name": "api_key",
              "value": "[TOKEN_2]"
            }
          ],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 200,
          "statusText": "OK",
          "httpVersion": "HTTP/2",
          "headers": [
            {
              "name": "content-type",
              "value": "application/json"
            }
          ],
          "cookies": [],
          "content": {
            "size": 180,
            "mimeType": "application/json",
            "text": "{\"orders\":[{\"id\":\"A-1042\",\"contact\":\"email-1@redacted.invalid\",\"total\":129.5}]}"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": 180
        },
        "cache": {},
        "timings": {
          "send": 0,
          "wait": 90,
          "receive": 6
        }
      },
      {
        "pageref": "page_1",
        "startedDateTime": "2026-10-24T09:15:02.630Z",
        "time": 1204,
        "request": {
          "method": "POST",
          "url": "https://app.harbor-supply.example/api/checkout",
          "httpVersion": "HTTP/2",
          "headers": [
            {
              "name": "authorization",
              "value": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQ4MjEiLCJlbWFpbCI6ImVtYWlsLTFAcmVkYWN0ZWQuaW52YWxpZCIsImV4cCI6MTg5MzQ1NjAwMH0.redacted-signature"
            },
            {
              "name": "content-type",
              "value": "application/json"
            }
          ],
          "cookies": [],
          "queryString": [],
          "headersSize": -1,
          "bodySize": 64,
          "postData": {
            "mimeType": "application/json",
            "text": "{\"order\":\"A-1042\",\"card\":\"[CARD_1]\"}"
          }
        },
        "response": {
          "status": 500,
          "statusText": "Internal Server Error",
          "httpVersion": "HTTP/2",
          "headers": [
            {
              "name": "content-type",
              "value": "application/json"
            }
          ],
          "cookies": [],
          "content": {
            "size": 62,
            "mimeType": "application/json",
            "text": "{\"error\":\"payment_failed\",\"request_id\":\"req_8812\"}"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": 62
        },
        "cache": {},
        "timings": {
          "send": 1,
          "wait": 1190,
          "receive": 13
        }
      }
    ]
  }
}

5.9 KB. Bodies that were changed were re-serialized, so Content-Length headers may no longer match.

Requests

3 requests, 1 failed
#MethodStatusURL, sanitizedTime
1POST200https://app.harbor-supply.example/api/login182 ms
2GET200https://app.harbor-supply.example/api/orders?status=open&api_key=%5BTOKEN_2%5D96 ms
3POST500https://app.harbor-supply.example/api/checkout1,204 ms

Failed means status 0 (no response) or 400 and above.

How it works

The file is read in your browser as JSON and walked request by request. Authorization headers keep their scheme and lose the credential; every cookie value in Cookie and Set-Cookie headers and in the cookie lists is replaced, with the names kept; query parameters, form fields, JSON body fields and headers whose names mean a credential (password, token, secret, key, session and similar) are replaced wherever they appear. Supported header, query, body and comment text is also searched for JSON Web Tokens, private keys, AWS, Google, GitHub, Stripe and Slack key formats, bearer tokens, email addresses and card numbers that pass the Luhn check. Each distinct value gets one placeholder for the whole file, so the same session or user can still be followed from request to request. A JSON Web Token keeps its header and claims, with matching sensitive fields and email claims replaced, and loses its signature, so it can still be read but no longer used. Text bodies stored as Base64 are decoded, cleaned and encoded again. The requests are listed with status and time, and the failed ones can be copied as a Markdown table for a ticket.

The full method, every rule and worked examples are on docs.tamperbox.dev.

Limits and interpretation

Replacement is by field name and known patterns. Names, postal addresses, phone numbers and other personal details in free text are not detected, so read the file before sharing it. Binary bodies such as images and fonts are kept as they are. Bodies that were changed are written out again, so Content-Length headers may no longer match. IPv4 addresses are kept unless you choose to replace them, because they are usually needed to diagnose network problems. URL-encoded and multipart form fields are inspected. Malformed JSON or multipart bodies are replaced as a whole; data deeper than 100 levels is refused. XML and arbitrary free text receive pattern matching only. Existing placeholder-looking credentials are replaced again. Files are limited to 50 MiB. Nothing is stored.

Frequently asked questions

Is a HAR file safe to send to support?

Not as exported. A HAR file records every header, cookie and body the browser sent and received, including session cookies and tokens that let anyone holding the file act as you until they expire. Sanitize it, read it, and sign out of the session you recorded once the ticket is resolved.

Why are the replacements numbered instead of all being the same?

So the file stays useful. If the same session cookie appears in twenty requests it becomes the same [COOKIE_1] in all of them, and a different session becomes [COOKIE_2], which shows support whether two requests belonged to the same session without revealing it.

Can support still read my JSON Web Tokens?

Yes, by default. The header and claims such as expiry, issuer and audience stay readable, with email claims replaced, and the signature is removed so the token cannot be used. Choose "Replace the whole token" if the claims themselves are sensitive.

References

W3C: HTTP Archive (HAR) format · RFC 7519: JSON Web Token · RFC 6265: HTTP State Management Mechanism (cookies) · OWASP: Logging Cheat Sheet, data to exclude.

Are you an AI agent? You are in the right place.

This page and every tool are available as plain text with their methods and limits, and the same checks run over MCP.