Scrub secrets from a HAR capture
Strip secrets from a HAR capture: secret-carrier headers, token-shaped values, cookies, sensitive query strings, bodies and WebSocket message payloads, counted …
Working…
Questions people ask
- What exactly gets redacted?
- The values, never the names. A fixed header set (authorization and friends) is redacted by name; headers that remain are checked for token-shaped values; cookies lose their values; query parameters with sensitive names lose their values in the queryString list and inside the captured URLs; bodies and WebSocket message payloads follow your policy choice; vendor extension fields are removed by default and reported by key name only. Counts land in the scrub report.
- Is the capture still a working HAR afterwards?
- Yes. Only the values change: method, URL path (minus redacted query values), statuses, names, sizes and structure stay so the file still opens in browser devtools. Timestamps and timings stay unless you turn that off, and the output is formatted the same way every run.
- Can anything be replayed from my upload?
- No. The job has no network, nothing in the capture is contacted or replayed, and the upload is deleted when the run finishes. The redaction happens locally in a sandboxed single-purpose run.
- Does scrubbing guarantee every secret is gone?
- No, and the report says so in the same breath as the counts. Heuristics catch known carriers and token-shaped values; a secret in an unusual header or an unusual name can survive. Skim the report's example header names and the remaining query names before re-sharing the file.
- Why choose keep, redact or drop for bodies?
- Keep is for captures where the payload text is the point you are sharing. Redact keeps the shape (a placeholder with its byte size) so the report still tells a story. Drop removes the text key entirely for the tightest option. All three leave the surrounding record intact, and all three apply equally to WebSocket message payloads. Keeping opaque payloads is an explicit opt-in: nothing here reviews what you kept.
- What are the limits?
- One capture up to 16 MB and the two outputs (the sanitized HAR and the scrub report). The tool refuses JSON that is not a HAR capture rather than guessing, and it never contacts any host mentioned in the file. Vendor extension fields (the underscore-prefixed keys some tools add) are stripped by default and reported only by key name, because their values have no schema; keeping them is an explicit opt-in.