HAR Sanitizer & Redactor

Scrub Secret Credentials from HAR Log Files.

Prevent session hijacking and API key leaks. Automatically redact passwords, session cookies, Bearer tokens, and secret keys from HTTP Archive logs before sharing with support.

Why Raw HAR Files are Dangerous

Unsanitized `.har` files record live session cookies in plain text. Anyone who receives your raw HAR file can paste those cookies into their browser and log into your account instantly without needing your password or 2FA!

Drag & drop your .har file here

Supports Chrome, Firefox, Edge & Safari HAR exports. Zero server uploads.

Choose HAR File
Active Redaction Rules
Automated client-side regex engine
Scanned Requests
0
HTTP entries parsed
Redacted Secrets
0
Tokens scrubbed safely
HTTP Diagnostics
100%
500 & 403 errors intact
Processing Time
< 0.1s
100% client-side memory
Sanitized HAR Output Audit Preview
[REDACTED] applied

Understanding HAR Files & Why Client-Side Redaction is Essential

When troubleshooting complex web application bugs, payment gateway failures, CORS errors, or cloud authentication issues, technical support teams at enterprise platforms like Stripe, AWS, Cloudflare, Zendesk, and Salesforce frequently ask users to export a .HAR (HTTP Archive) file. While HAR files serve as an invaluable diagnostic "black box" recorder for browser network requests, 95% of users don't realize that raw HAR logs record secret passwords, session cookies, Bearer tokens, and private API keys in plain unencrypted text.

Attaching an uncleaned HAR log to a support ticket or emailing it to a third-party vendor instantly creates high-severity security vulnerabilities. Anyone possessing a raw HAR file can copy live session tokens to perform full session hijacking, extract secret API keys (`sk_live_`), or access confidential POST payloads without needing your account password. ShiftTools HAR Sanitizer provides a zero-upload, 100% client-side redaction engine that scrubs private authentication credentials while preserving 100% of diagnostic HTTP status codes (such as 500 Internal Server Error, 403 Forbidden, and 404 Not Found) intact for engineering analysis.

100% Zero-Upload Privacy

All sanitization algorithms execute 100% locally inside your browser's client-side memory using JavaScript. Your log files are never sent to external cloud servers or stored in remote databases.

Session Cookie Protection

Scubs sensitive session tokens (`PHPSESSID`, `session_id`, `JSESSIONID`, `Set-Cookie`) to eliminate session hijacking and credential replay attack vectors completely.

Diagnostic Integrity Intact

Preserves HTTP error codes, network latency metrics, response headers, URL query parameters, and stack tracebacks completely intact for support engineers.

Custom RegEx & String Matching

Supports custom secret keys, proprietary internal tokens, tenant UUIDs, and regular expressions to scrub custom organization payloads in real time.

Non-Blocking Async Engine

Processes large 10MB, 20MB, or 50MB+ HAR log files smoothly without freezing your browser interface using asynchronous slice batching.

Offline & Air-Gapped Ready

Operates seamlessly in air-gapped corporate environments and offline networks. Load the page once and run sanitization without active Wi-Fi.

Enterprise Data Compliance: SOC 2, HIPAA, & GDPR Log Protection

Modern enterprise security compliance frameworks (including SOC 2 Type II, ISO/IEC 27001, HIPAA Security Rule § 164.312, and GDPR Article 32) mandate strict controls over the transmission of Personally Identifiable Information (PII) and authentication credentials. Sharing an unredacted HAR file containing real customer passwords, authorization tokens, or session headers constitutes a direct security policy violation.

By utilizing client-side HAR sanitization, security teams and developers ensure that credentials never touch external cloud servers, third-party log parsing tools, or unencrypted email attachments. Redacting sensitive data before ticket creation ensures your organization maintains compliance audits effortlessly.

How to Export a .HAR File safely in Major Web Browsers

Google Chrome
  1. Press F12 or Cmd+Option+I to open Developer Tools.
  2. Click the Network tab.
  3. Check the Preserve log checkbox.
  4. Reproduce the issue on your web page.
  5. Right-click any network request and select "Save all as HAR with content".
Brave Browser
  1. Press F12 to open Developer Tools.
  2. Select the Network tab.
  3. Check Preserve log (and verify Brave Shields status if debugging CORS).
  4. Reproduce the network error or request.
  5. Right-click any entry and choose "Save all as HAR with content".
Microsoft Edge
  1. Press F12 to launch Edge Developer Tools.
  2. Navigate to the Network tab.
  3. Reproduce the page error or API request.
  4. Click the Export HAR... button (down-arrow icon) or press Ctrl + S.
Mozilla Firefox
  1. Press F12 to open Firefox Web Developer Tools.
  2. Select the Network tab.
  3. Perform the steps that trigger the bug.
  4. Click the gear settings icon on the top right of the Network panel and select "Save All As HAR".
Apple Safari (macOS)
  1. Open Safari Preferences (Cmd + ,) → Advanced → Check "Show Develop menu".
  2. Press Cmd + Option + I to open Web Inspector.
  3. Click the Network tab and reproduce the issue.
  4. Click Export on the top right of the Network tab to save the HAR file.

Frequently Asked Questions

Everything you need to know about HAR log security, client-side redaction, and safe file sharing.

1. What is a .HAR file and why do technical support teams request it?
A HAR (HTTP Archive) file is a JSON-formatted archive generated by web browsers (like Chrome, Firefox, Edge, and Safari) that records every network request, response header, status code, and timing metric during a browsing session. Technical support engineers request HAR logs to diagnose API failures, page load bottlenecks, CORS errors, and HTTP status code errors (like 500 Internal Server Error or 403 Forbidden) that occur on your local machine.
2. Why is sending an uncleaned .HAR file dangerous?
A raw .HAR file records everything in plain unencrypted text, including live session cookies (`session_id`, `PHPSESSID`), Bearer authorization tokens, secret API keys (Stripe, AWS, GitHub), and form payloads (passwords, credit card numbers). Anyone who gains access to an uncleaned .HAR file can copy your live session tokens and immediately hijack your account without needing your password.
3. Are my HAR files uploaded to your servers during sanitization?
No. ShiftTools HAR Sanitizer operates 100% client-side inside your web browser's local memory. Your HAR log files never leave your computer, zero data is uploaded to remote servers, and the tool continues to function even if you disconnect from the internet.
4. Which sensitive tokens and secrets are automatically redacted by default?
By default, the active redaction rules automatically scrub:
  • Session Cookies (`Cookie`, `Set-Cookie`, `PHPSESSID`, `session_id`, `JSESSIONID`)
  • Authorization Tokens (`Bearer`, `Basic`, `OAuth`, JWT token headers)
  • Secret API Keys (`sk_live_`, AWS `AKIA` keys, GitHub tokens, Stripe secrets)
  • POST Form Payloads (`password`, `secret`, `card_number`, `cvv`)
  • URL Query Credentials (`?token=`, `?access_token=`, `?api_key=`, `?code=`)
  • Internal IP Addresses (`10.x.x.x`, `192.168.x.x`, `172.16.x.x`)
  • Custom Vendor Headers (`x-api-key`, `x-csrf-token`, `x-amz-security-token`)
  • Credit Card Numbers & Personally Identifiable Information (PII) patterns
5. Will redacting sensitive data break diagnostic status codes like HTTP 500 or 403?
No. The redaction engine only replaces secret string values (such as auth tokens or cookie strings) with clean labels like [REDACTED_COOKIE] or [REDACTED_AUTH_TOKEN]. All HTTP status codes, timing metrics, server response headers, URL endpoints, and error stack tracebacks remain 100% intact for engineering analysis.
6. Can I scrub custom secret keys, environment variables, or regex patterns?
Yes. You can enter any custom key name or regular expression in the "Custom Secret Key / RegEx Pattern" input field. The engine will scan all request and response structures and replace matching occurrences with [REDACTED_CUSTOM] in real time.
7. How does client-side HAR sanitization protect against session hijacking?
Session cookies like session_id allow servers to verify authenticated users. If an attacker acquires a raw HAR file, they can import the cookie headers into their browser to hijack your session. Redacting these headers prevents session replay attacks completely.
8. Why should I sanitize HAR logs before attaching them to public Zendesk or Jira tickets?
Support ticketing platforms are often accessed by multiple customer service representatives, contractors, or third-party vendors. Once attached, uncleaned files remain in ticket histories permanently. Redacting your HAR logs ensures private credentials are never exposed in support archives.
9. Does this HAR Sanitizer tool work offline or without an internet connection?
Yes. Because the entire processing logic is written in client-side JavaScript, once you load the web page, you can disconnect your Wi-Fi or internet connection and sanitize files completely offline.
10. Is there any file size limit for sanitizing HAR files in my browser?
There is no fixed file size limit. Our non-blocking asynchronous processing engine handles large 10MB, 20MB, or 50MB+ HAR logs easily without freezing your browser window.
11. How do I export a .HAR file from Google Chrome, Firefox, Edge, or Safari?
In Google Chrome, Edge, or Firefox: Press F12 to open DevTools, select the Network tab, reproduce the issue, right-click anywhere in the network request list, and select "Save all as HAR with content".
12. Can I copy the sanitized HAR JSON directly to my clipboard without saving a file?
Yes. Click the "Copy Clean HAR JSON" button in the dashboard to instantly copy the sanitized HAR data directly to your system clipboard for quick pasting into slack or support chats.
13. What is the difference between client-side HAR sanitization and server-side log cleaning tools?
Server-side log cleaning tools require uploading unencrypted raw HAR files containing active session tokens and passwords over the internet to a third-party server. Client-side sanitization runs processing directly inside your browser memory, ensuring secrets never touch the wire or third-party cloud infrastructure.
14. How does HAR sanitization help organizations maintain SOC 2 and GDPR compliance?
Sharing unredacted HAR files containing Personally Identifiable Information (PII) or authentication tokens violates GDPR Article 32 and SOC 2 Type II confidentiality controls. Sanitizing HAR files before external sharing enforces data protection policies automatically.
15. Can HAR Sanitizer redact multi-part form data, JSON payloads, and GraphQL queries?
Yes. The sanitization engine recursively parses JSON body content, URL-encoded postData, multi-part form parameters, and GraphQL query strings to replace password fields, credit cards, and private variables with clean redaction labels.