Sanitise a HAR File Before Sharing
Redact Authorization headers, cookies, and API keys from Chrome or Firefox HAR exports before handing them to support teams or filing bug reports.
Open HAR Sanitizer & Replay Packager.
- A vendor's support team asks for a HAR file to debug an API integration issue.
- You want to attach network logs to a GitHub issue or Jira ticket without leaking session tokens.
- A QA engineer is sharing a HAR recording with a third-party contractor.
- You need to store HAR files in a shared repository or ticketing system safely.
- Export the HAR from Chrome DevTools: Network tab → right-click → Save all as HAR with content.
- Open HAR Sanitizer & Replay Packager and load or paste the HAR JSON.
- Review the list of detected sensitive headers (Authorization, Cookie, X-Api-Key, etc.).
- Click Sanitise to replace values with
[REDACTED]and download the cleaned HAR.
- HAR files can contain full request and response bodies including JSON payloads with PII. Review the body redaction options as well as headers.
- If replaying the sanitised HAR, you will need to re-inject valid credentials — the sanitised file is for sharing, not reuse.
- Large single-page apps can generate HAR files of 50 MB or more. The tool handles this in-browser without uploads.
- Look for secrets in query parameters too, not just headers — some APIs pass tokens as
?access_token=....
API request with bearer token
{
"name": "Authorization",
"value": "Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyIn0.sig"
},
{
"name": "Cookie",
"value": "session=abc123xyz; _ga=GA1.1.123456"
},
{
"name": "X-Api-Key",
"value": "sk_live_abcdef1234567890"
}
{
"name": "Authorization",
"value": "[REDACTED]"
},
{
"name": "Cookie",
"value": "[REDACTED]"
},
{
"name": "X-Api-Key",
"value": "[REDACTED]"
}
A HAR (HTTP Archive) file is a JSON log of all network requests captured by browser DevTools. It includes full request/response headers, cookies, bodies, and timings — making it useful for debugging but risky to share without redaction.
By default: Authorization, Cookie, Set-Cookie, X-Api-Key, X-Auth-Token, and other common secret header names. You can customise the list and also choose to redact request/response bodies.
Use the Replay Packager to convert the HAR into cURL commands or a Postman collection. You will need to inject your own valid credentials before replaying, as the sanitised file has tokens replaced with [REDACTED].
Open DevTools (F12 or Ctrl+Shift+I), select the Network tab, reproduce the issue, then right-click any request row and choose "Save all as HAR with content". The file downloads to your default folder.
Privacy-first: runs locally in your browser. No uploads.