Log & HAR Data Masker
A tool that detects sensitive data in log files and HAR (browser network recordings) — cookies, Authorization headers, tokens, API keys, email addresses, IP addresses, and more — masks it, and lets you download the result. Choose exactly what to mask; everything runs in your browser.
Automatic detection has pattern-based limits. Always review the masked output for any remaining sensitive data before sharing it.
How to use
- Paste a log or HAR (JSON), or load a file with "Open file" or by drag and drop.
- Under "What to mask", choose the kinds of data to hide — cookies, authorization headers, tokens, email addresses, IP addresses, and custom terms. Each item shows how many matches were found.
- Under "Mask format", choose labeled masks that give the same value the same number (e.g. [EMAIL_1]) or plain asterisks (****).
- Review the result and save it with "Download" or "Copy to clipboard". Before sharing, double-check by eye that no sensitive data remains.
About this tool
When investigating bugs or contacting support, you often need to share log files or HAR files. These files can contain session cookies, auth tokens, and API keys that could let someone take over an account, as well as personal data such as email and IP addresses. This tool automatically detects and masks them before you share.
When you provide a HAR or JSON, the tool parses its structure and masks values precisely based on fields such as headers, cookies, and queryString, then also applies pattern detection to strings like URLs and response bodies. For text logs, it detects header lines such as "Cookie:" and "Authorization:", JWTs, common API key formats, and fields like token=… or "password": …. Labeled masks give identical values the same number, so you can still follow which user or token is which after masking.
Your unmasked data never leaves your browser. Pattern-based detection has its limits, though — specify custom IDs or names that appear in text via "Custom terms", and always review the result before sharing.
Frequently asked questions
Can I open the masked HAR in a HAR viewer?
Yes. HAR and JSON input keeps its structure — only values are replaced — and is output as indented JSON, so it loads directly in browser dev tools or a HAR analyzer.
What's the difference between "Labeled" and "Asterisks"?
"Labeled" replaces values with a type and number such as [EMAIL_1] or [TOKEN_2], giving identical values the same number — handy for tracking which requests share a token without revealing it. "Asterisks" replaces everything with ****.
A version number was masked as an IP address.
Strings of four dot-separated numbers like "1.2.3.4" can't be distinguished from IPv4 addresses, so they may be masked. Uncheck "IP addresses" if you don't need it.
Are files uploaded to a server?
No. Everything from loading the file to masking and downloading happens in your browser.