HAR Sanitizer
Strip cookies, tokens and passwords out of HAR files before you send them to support, a vendor or a forum. It runs on your device and shows you what it found.
- 1 permission: storage
- No network access
- No account
The Problem
A HAR file records everything your browser did, including your session cookies, API tokens and passwords. Send it to support, a vendor or a forum and you have sent them your login.
What HAR Sanitizer Does
Redacts As You Record
Open the HAR Sanitizer tab in DevTools and use the page. Requests appear already redacted, and the raw values are never saved.
Or Clean A File You Already Have
Click the toolbar icon, drop in a .har file and download the cleaned version, with an optional report, summary and audit log.
Catches The Usual Suspects
Cookies, Authorization and API-key headers, URL parameters, form and JSON fields, JWTs, cloud and payment keys, card numbers, emails, IP addresses, URL credentials and random-looking tokens.
You Set How Hard It Guesses
An over-redaction slider (Readable, Balanced, Thorough) decides the trade-off. Balanced leaves fonts, images, CSS and JS readable instead of blanking build hashes.
Share-Ready Check
One button stops recording, re-scans the result for leftover secrets, shows a clear verdict and downloads the file.
Built For Repeat Use
Per-site profiles, WordPress and Stripe starter rules, shareable team rules and restorable encrypted mappings.
How It Works
Record Or Open
Use the HAR Sanitizer tab in DevTools, or drop a .har file into the popup.
Review What Was Redacted
Click any request to see what changed. Choose Keep or Always redact.
Press Share-Ready
It re-scans, shows a verdict and downloads a file that is safe to send.
Verify It Yourself
You shouldn't have to take our word for it. Here is exactly what the extension can do, and how to check.
- storage
- Saves your settings: preset, level, rules and site profiles. HAR contents are never written to storage.
- DevTools panel
- Adds the HAR Sanitizer tab so requests can be redacted as they are recorded.
- Website access
- None. No host permissions are requested.
- Network
- None. The browser itself blocks every outgoing connection from the extension.
- Remote code
- None.
Open the extension's built-in “Prove it’s local” page to see the network block live, or open chrome://extensions and check the permissions yourself. Read the privacy policy.
Questions
Does it upload my HAR file?
No. The extension has no server and makes no network requests. The browser enforces this through the extension's content-security policy, and the “Prove it’s local” page shows it live.
What does it redact?
Cookies, Authorization and API-key headers, URL parameters, form and JSON body fields, JWTs, cloud and payment keys, card numbers, emails, IP addresses, URL credentials and random-looking tokens.
Will the cleaned file still be useful for debugging?
Yes. Balanced mode, the default, keeps fonts, images, CSS and JS readable. Move the slider to Thorough if you would rather be safe than readable.
Is anything saved on my device?
Only your settings. HAR contents and recorded requests are never written to storage. While you record, redacted requests sit in the panel's memory until you clear them or close DevTools.
Can it guarantee nothing is left?
No tool can promise that. Share-ready re-scans the result and gives a verdict, which catches most leftovers. For very sensitive files, still skim the output before you send it.
Share The HAR, Not Your Session.
Free, no account, and everything stays on your device.
Add To Chrome (opens in a new tab)