How to Share a HAR File Without Leaking Tokens

A HAR file is a JSON log of browser network activity. Support teams ask for one because it shows failed logins, redirects, and API errors. The same file can also hold a live session.

Chrome and Edge no longer put Cookie, Set-Cookie, or Authorization into a default export. That change does not empty the file. Query parameters such as access_token, and JSON fields named password or refresh_token, can still be present. Firefox Save All as HAR does not apply Chrome’s default strip.

For a capture that may include those leftover fields, the LeetTools HAR Sanitizer redacts matching names in this browser tab and downloads a cleaned HAR.

What Chrome already removes

From Chromium 130, DevTools defaults to Export HAR (sanitized). That export omits:

• the Cookie request header;
• the Set-Cookie response header;
• the Authorization header.

The Network panel setting Allow to generate HAR with sensitive data unlocks Export HAR (with sensitive data). Some vendors still ask for that fuller export because they need cookies to diagnose auth. Auth0’s support docs tell people to enable the setting before exporting.

Default sanitizing is header-scoped. It does not promise to remove:

• access_token, id_token, or similar keys on the query string or in request.url;
• password, client_secret, or refresh_token in request or response JSON;
• custom headers that are not Cookie or Authorization, such as a vendor Api-Token name.

Choose a sharing method

Chrome’s default export is enough when you did not enable the sensitive-data setting and the failing request does not put credentials in the query string or a JSON body. Use the sanitizer when support asked for the sensitive export, when you captured in Firefox, or when you can see token or password in the URL or payload.

Option 1: Share Chrome’s default export

1. In Chrome, open DevTools with F12 or Cmd+Option+I, then open Network.
2. Check Preserve log, clear the log, and reproduce the issue.
3. Export with Export HAR (sanitized). Do not turn on Allow to generate HAR with sensitive data unless support asked for cookies.

Search the saved file for access_token, password, secret, and Authorization. If those strings are absent, the default export may be all you need.

Option 2: Redact leftover query and body fields locally

1. Open HAR Sanitizer.
2. Choose Open HAR and select the .har file, or choose Load Sample to see the matching field names on a fake login.
3. Confirm Query Secrets and Body Secrets are on if the capture might include URL tokens or JSON passwords.
4. Leave Cookies and Auth Headers on when the file came from Firefox or from Chrome’s sensitive export.
5. Review Values To Redact. The list shows field names, not the secret values.
6. Choose Download Sanitized HAR and send that copy.

Open Full Size

The sanitizer walks HAR fields instead of running regular expressions on the whole file, so the download stays valid JSON. It redacts all cookie values. Headers, query keys, and JSON or form fields are redacted when the name looks like token, secret, session, JWT, password, or Authorization. A leftover JWT in a generic field can be inspected in the JWT Debugger without pasting the original HAR.

What “local” means here

HAR Sanitizer reads the selected file in its browser tab. LeetTools does not receive the capture. The website still loads page resources; local redaction does not mean the site is offline.

Option 3: Edit the HAR as text

Open the file in an editor and replace remaining vendor-specific values only after the structured pass. Keep a copy of the original until support confirms they can work from the redacted file. A missed comma will make the HAR unreadable.

This route is a poor first step. Cookie headers and JSON bodies are easy to only half-edit.

When support asks for a sensitive HAR

Ask whether they need cookies. If they do, enable Chrome’s sensitive export, reproduce once, then run HAR Sanitizer so query tokens and JSON passwords are not sitting next to the cookies they asked for.

Prefer the vendor’s own ticket uploader when it redacts on the client before the file leaves your machine. Email, chat, and generic attachments do not.

Do not treat a redacted HAR as a revocation. If a live token was in an earlier unredacted copy, rotate that credential.

The practical recommendation

Use Chrome’s default sanitized export for ordinary page bugs. Use HAR Sanitizer when the capture may still contain query tokens or JSON passwords, or when the file is a Firefox or sensitive Chrome export. Search the downloaded file for token and password before you send it.