HAR file sanitizer and viewer (free, no signup)
A HAR file records every request your browser made, including cookies, auth tokens, and API keys. This free tool opens the file entirely in your browser, strips the sensitive parts, and gives you a clean HAR to share plus a waterfall summary. Nothing is uploaded; the file never leaves your machine.
Sanitiser
Sanitise your HAR file
Drop a .har file here
Parsed with FileReader and JSON.parse on this page. No upload; files up to 50 MB.
Redaction rules (all on by default)
Every redacted value becomes [REDACTED], nothing is deleted, so the file stays valid HAR and opens in any viewer.
Example output from a fictional checkout session. Drop your own .har file to replace it; the file never leaves your browser.
Redaction receipt for checkout-session.har: 23 values replaced with [REDACTED] across 5 requests.
- Cookies (cookie and set-cookie headers and cookies arrays): 11 replaced (6 headers, 5 cookie values)
- Auth headers (authorization, x-api-key, set-cookie, proxy-authorization): 2 replaced
- Sensitive query strings (token, key, secret, session, auth, password, bearer, in queries and fragments): 2 replaced
- Request and response bodies: 8 replaced (2 request, 6 response)
5 requests, 1 failed, 127.0 kB received, slowest 2,141 ms.
| Method | URL | Status | Time | Size |
|---|---|---|---|---|
| GET | app.example.com/dashboard | 200 | 214 ms | 18.4 kB |
| GET | api.example.com/v1/session?... | 200 | 96 ms | 1.2 kB |
| POST | api.example.com/v1/orders | 500 failed | 2,141 ms slow | 640 B |
| GET | api.example.com/v1/orders?... | 200 | 388 ms | 22.7 kB |
| GET | cdn.example.com/app.css | 200 | 41 ms | 84.1 kB |
## Network summary (sanitised HAR: checkout-session.har) 5 requests, 1 failed, 127.0 kB received, slowest 2,141 ms. Sanitised in the browser with the free HAR file sanitizer at https://quell.sh/tools/har-file-sanitizer: 23 values replaced with [REDACTED] (11 cookies, 2 auth headers, 2 query string values, 8 bodies). | Method | URL | Status | Time | Size | | --- | --- | --- | --- | --- | | GET | app.example.com/dashboard | 200 | 214 ms | 18.4 kB | | GET | api.example.com/v1/session?... | 200 | 96 ms | 1.2 kB | | POST | api.example.com/v1/orders | 500 | 2,141 ms | 640 B | | GET | api.example.com/v1/orders?... | 200 | 388 ms | 22.7 kB | | GET | cdn.example.com/app.css | 200 | 41 ms | 84.1 kB | ## Failed requests ``` POST https://api.example.com/v1/orders Status: 500 Internal Server Error Time: 2,141 ms, size: 640 B, type: application/json ```
Add the repository as owner/repo, for example octocat/hello-world.
Why it matters
What is in a HAR file and why support teams ask for one
HAR stands for HTTP Archive: a JSON file the browser's Network tab exports, recording every request the page made. For each one it stores the URL and query string, the request and response headers, the cookies, the timings, and usually the full request and response bodies. That completeness is why support teams ask for one when a bug involves the network: it shows exactly what went over the wire, in order, with timings attached.
It is also why a raw HAR file is dangerous to share. Your session cookie is in there. So is every authorization header, any API key sent as a header or a query parameter, and whatever you typed into forms while recording. Someone with the file can often sign in as you. The standard advice is to open the file and scrub it by hand, which nobody does properly at 40 MB.
This sanitiser applies four rules, each with its own toggle and its own line in the receipt:
- Cookies. Cookie and set-cookie headers and the cookies arrays on both requests and responses.
- Auth headers. authorization, x-api-key, set-cookie, and proxy-authorization, matched case-insensitively.
- Sensitive query strings. Any parameter whose name contains token, key, secret, session, auth, password, or bearer, replaced in the URL string itself (fragments included, where OAuth flows put access tokens), in the queryString array, and in redirect URLs.
- Bodies. Request postData (text and form params), response content text, and WebSocket message payloads recorded by Chrome, on by default because bodies can contain anything.
Every replaced value becomes [REDACTED] and nothing is deleted, so the file stays valid HAR and still opens in any viewer. The receipt above the waterfall counts every replacement, which is how you check the tool did what it claims before you attach the file anywhere. The waterfall itself flags the failures and the slowest requests, and the Markdown export puts the summary and the failed requests in a shape a ticket, and a coding agent reading that ticket, can use.
A sanitised HAR is usually one exhibit in a bigger report. The bug report template generator builds the write-up with a slot for the failed network call, the steps to reproduce generator turns what you did into numbered steps someone can replay, the console log cleaner does for a console paste what this tool does for the network tab, and the bug severity and priority calculator sets the triage labels once the evidence is in.
FAQ
HAR file questions
What is a HAR file?
A HAR file (HTTP Archive) is a JSON recording of the network traffic behind a page: every request the browser made, with its URL, query string, headers, cookies, timings, and usually the full request and response bodies. You export one from the Network tab of the browser's developer tools, and support teams ask for it because it shows exactly what went over the wire, which no screenshot can. The same completeness is the catch: whatever your browser sent while you were recording, including session cookies and API keys, is in the file in plain text.
Is it safe to share a HAR file?
Not as recorded. A raw HAR file carries your cookie headers, your authorization and API key headers, any tokens in query strings, and full request and response bodies, which can include passwords typed into forms and personal data returned by APIs. Someone holding the file can often replay your session with it, which is why so many vendor support pages carry a warning next to the words 'send us a HAR file'. Sanitise it first: strip the cookies, the auth headers, the sensitive query parameters, and the bodies. That is what this tool does, in your browser, with a receipt showing exactly what was replaced.
What does this tool remove from a HAR file?
Four categories, each with its own toggle. Cookies: cookie and set-cookie headers and the cookies arrays on both requests and responses. Auth headers: authorization, x-api-key, set-cookie, and proxy-authorization, matched case-insensitively. Sensitive query strings: any parameter whose name contains token, key, secret, session, auth, password, or bearer, replaced in the URL itself, fragment included, as well as the queryString array. Bodies: request postData, response content text, and recorded WebSocket message payloads, on by default because bodies can hold anything. Every removed value is replaced with [REDACTED] rather than deleted, so the file stays valid HAR and opens in any viewer, and the redaction report counts each replacement so you can check the work.
Is my HAR file uploaded when I use this?
No. The file is opened with the browser's own FileReader and parsed as JSON on this page. The sanitising, the redaction receipt, the waterfall table, and the download are all plain JavaScript running locally; the tool's code path makes no network calls at all, so nothing in the file leaves your machine. The downloaded copy is generated in the browser too. If you want to verify that, open the Network tab while you use the tool: no request carries your file. The only traffic you may see is this site's own analytics and feedback widget, which never touch the file. Given what a HAR file contains, that is the whole point.
How do I record a HAR file in Chrome, Firefox, or Edge?
In Chrome or Edge, open DevTools with F12, go to the Network tab, tick Preserve log, then reload the page and reproduce the problem. Click the export button above the request list (the down arrow, labelled Export HAR) to save the file. In Firefox, open the Network tab the same way, reproduce the bug, then right-click anywhere in the request list and choose Save All As HAR. Keep the recording short and focused on the failure: less noise in the waterfall, and less to sanitise. Then drop the file into the tool above.