Redact query tokens, form passwords, and leftover cookies from a HAR file in your browser before sharing it with support.
Chrome and Edge default HAR exports already drop Cookie, Set-Cookie, and Authorization. This page also redacts query tokens such as access_token, and token or password fields in request and response JSON or forms, then downloads a sanitized HAR.
Firefox Save All as HAR, and Chrome’s Export HAR (with sensitive data), still include cookies and Authorization. Use those exports when support needs the extra headers, then run this pass before sharing.
It does not replay requests, draw a waterfall, or promise to remove every email, card number, or vendor-specific field. All cookie values are redacted. Headers, query keys, and JSON or form fields are redacted only when the name looks like token, secret, session, JWT, password, or Authorization. Multipart and XML bodies are left as-is.
Files larger than 80 MB should be split or cleaned with a local CLI. Processing stays in this browser tab; LeetTools does not receive the HAR.
How-to
Chrome’s default HAR export already drops Cookie and Authorization. Query tokens such as access_token and password fields in JSON can remain. Compare Chrome, Firefox, and a local sanitizer.
Read guide