HAR File Sanitizer
A HAR file records every request your browser made, including cookies and Authorization headers. This tool replaces those values with [REDACTED] so the file is safer to send to support. In a one-request sample it masks 1 header, 1 cookie and 1 query value. Drop your own .har file in to see the counts.
How to use
- Export a HAR file from your browser's Network tab (Save all as HAR) and drop it on the box, or choose it with the button. The file is read locally and never uploaded.
- Tick the options you want. Masking cookies, auth headers, secret query parameters and JWTs is always on. You can also remove response bodies, which makes the file much smaller.
- Check the summary of what was masked and the table of slowest requests, then press Download to save the cleaned .har.
How it works
The file is parsed as JSON and every entry is visited once. Header values are replaced when the name is Cookie, Set-Cookie, Authorization, Proxy-Authorization, X-API-Key, X-Auth-Token and similar, or when it ends in token, secret or api-key. Every cookie value in the cookie arrays is replaced, whatever its name.
Query strings (in the URL and in the queryString array), form fields and JSON keys are masked when the name contains token, password, secret, api key, session, auth, credential, signature, csrf, otp or bearer, or is exactly code. Any JWT (three dot-separated parts starting with eyJ) is replaced wherever it appears. Names and values that do not match are left untouched, so the file stays useful for debugging.
Total time is the entry's time field, or the sum of its timing phases when missing. TTFB is the wait phase. A phase of -1 means "not applicable" and counts as zero. Each waterfall bar starts at the request's offset from the first request and stacks blocked, DNS, connect, send, wait and receive.
Large files work as long as your browser can hold the parsed JSON, usually up to a few hundred MB. Files over about 100 MB can take several seconds and a lot of memory, so remove response bodies first if you can.
What a HAR file can leak
| Where | Example | Risk |
|---|---|---|
| Cookie header | sessionid=9f2c... | Anyone with it can act as you |
| Authorization header | Bearer eyJhbGci... | API access until it expires |
| Query string | ?access_token=... | Tokens also end up in server logs |
| Form or JSON body | {"password":"..."} | Login credentials in plain text |
| Response body | Account pages, API results | Personal data of you or customers |
Before you send a HAR to support
- Record only the page that shows the problem. A shorter capture has less to leak.
- Sign out and rotate any session or key that was in the capture, even after sanitizing.
- Tick Remove response bodies unless support asks for them.
FAQ
Is my HAR file uploaded anywhere?
No. The file is read and rewritten inside your browser tab. Nothing is sent to a server and nothing is stored, so closing the tab erases it.
Is the cleaned file completely safe to share?
It is much safer, but not guaranteed. Matching is by name and pattern, so a secret in an oddly named field, a plain-text body, a URL path segment or an HTML page can survive. Search the downloaded file for your own account names, emails and keys before sending it.
Why are response bodies removed only as an option?
Bodies are often what a developer needs to reproduce a bug. They also contain the most personal data, such as account pages and API results. Removing them shrinks the file and removes most remaining risk, at the cost of detail.
What does TTFB mean here?
Time to first byte, taken from the wait phase of each request: the time between sending the request and receiving the first byte of the response. High values usually point to a slow server, not a slow network.
Will a masked HAR still import into DevTools?
Yes. The structure is unchanged and only values are replaced, so Chrome, Firefox and Safari can still open it. Replaced values show as [REDACTED].
Why did it mask a value I wanted to keep?
Any name containing words like token, session or auth is treated as secret. That includes harmless fields such as csrf tokens or session length. The tool prefers masking too much over leaking one.