Home
Sign up — start free Sign in

Free tool

HAR sanitizer

This tool removes tokens, cookies, API keys, passwords and email addresses from a HAR file before you share it with a coding agent, a support team or a teammate. It runs in your browser, and the file never leaves this page.

Sanitize a HAR file How to export a HAR

Free. No account. Works with the network off after the page loads.

Sanitize a HAR file

Choose a .har file. The page reads it in this tab, removes secrets and gives you a new file to download. Nothing is uploaded.

Options

Header names, URLs without their secret values, status codes and timings are always kept.

How to export a HAR file

Open the page that fails, start recording network traffic, repeat the problem, then save the recording.

  • Chrome and EdgeExport HAR
    1. Open DevTools with F12, or Cmd+Option+I on a Mac.
    2. Open the Network tab and turn on Preserve log.
    3. Repeat the problem.
    4. Press the Export HAR button (the down arrow) in the Network toolbar.
  • FirefoxSave All As HAR
    1. Open DevTools with F12, or Cmd+Option+I on a Mac.
    2. Open the Network tab and turn on Persist Logs in its settings menu.
    3. Repeat the problem.
    4. Right-click any request and choose Save All As HAR.
  • SafariExport
    1. In Settings, Advanced, turn on Show features for web developers.
    2. Choose Develop, Show Web Inspector, then the Network tab.
    3. Repeat the problem.
    4. Press Export in the Network tab and save the .har file.

Chrome and Edge 130 and later leave out the Cookie, Set-Cookie and Authorization headers by default (checked 26 October 2026). Tokens in URLs, other headers, request bodies and responses stay in the file.

What it removes

Each value is replaced with a marker, so the file keeps its structure and stays valid JSON.

What the HAR sanitizer removes
WhereWhat is replacedMarker
HeadersAuthorization, Proxy-Authorization, Cookie, Set-Cookie, X-Api-Key, X-Auth-Token, X-CSRF-Token, and any header whose name contains token, secret, session, auth, key, signature or password[redacted]
CookiesEvery request and response cookie value. Cookie names stay.[redacted]
URLsQuery and fragment parameters named like token, code, state, key, secret, password, session, sig, signature, auth, jwt, access, refresh, apikey, api_key or client_secret, path parameters such as ;jsessionid=, and a user name and password before the host. The same rule covers Referer, Location, Refresh, Link and redirect URLs, and the script URLs Chrome records for each request.[redacted]
Request bodiesForm, multipart and JSON fields with those names, and card fields such as card[number], cvc and cvv[redacted]
Response bodiesJSON fields with those names, such as access_token and refresh_token, also in event streams and JSON Lines. In plain text and HTML, values after a name like password= or token:, and the value of a form field or meta tag with such a name, such as csrf-token.[redacted]
WebSocket messagesFields with those names in the messages Chrome records. Remove all request bodies and Remove all response bodies also empty sent and received messages.[redacted]
AnywhereStrings shaped like a JWT[redacted-jwt]
AnywhereBearer tokens and common API key shapes: sk-, sk_live_, ghp_, github_pat_, xoxb-, AKIA, AIza, glpat-, npm_ and private key blocks[redacted-key]
AnywhereEmail addresses (an option, on by default)[redacted-email]
AnywhereCard numbers of 13 to 19 digits that pass the Luhn check[redacted-card]

What it does not do

It cannot know every custom secret format your app uses. Values in URL path segments and in fields with ordinary names, such as ?t= or a customer address, stay in the file. Base64 bodies, such as images, fonts and binary WebSocket messages, are not searched; the report lists base64 response bodies, and Remove all response bodies drops them. Read the report and search the file for anything private before you share it.

BugTape records failed requests for you

In a web app with the BugTape SDK, failed requests are recorded with the error that followed and kept in one issue, with no HAR export. Your coding agent reads them over MCP. See how it works or break a checkout in the live demo.

Questions

Does my HAR file leave my browser?

No. The page reads the file in this tab and does all the work there. It sends no file content anywhere and stores none. After the page loads, it works with the network off.

Is a sanitized HAR file safe to share?

It is safer. The tool removes the secret formats listed on this page. It cannot know every custom secret your app uses. Values in URL path segments and in fields with ordinary names stay, and it does not search base64 bodies. Read the report and search the file for anything private before you share it.

How is this different from Chrome's sanitized export?

Chrome and Edge 130 and later leave out the Cookie, Set-Cookie and Authorization headers by default. Tokens in URLs, other headers, request bodies and responses stay in the file. This tool also removes those.

How do I give the HAR file to a coding agent?

Download the sanitized HAR and attach it to the chat, or press Copy summary for your agent and paste the list of failed and slow requests. The summary is made from the sanitized file only, and it quotes only JSON error bodies.

Let BugTape keep the evidence for you.

Start free Try the live demo
  • Free plan
  • No credit card
  • Set up in minutes