Last updated: October 26, 2026
Summary
HAR Sanitizer does not collect, transmit, sell, or share any personal data. Everything it does happens on your device, inside your browser.
What HAR Sanitizer does
HAR Sanitizer removes sensitive information (such as cookies, tokens, passwords, API keys, and personal data) from HAR network recordings, either captured in Chrome DevTools or loaded from .har files you choose. It is designed so that nothing you process ever leaves your computer.
Data we collect
None. We do not collect, receive, or have access to:
- the contents of your HAR files or network recordings
- the web pages you visit or your browsing history
- your cookies, tokens, passwords, or any other credentials
- personal information of any kind
- analytics, usage statistics, or crash reports
We do not use accounts, cookies, trackers, advertising, or third-party analytics.
How your data is processed
HAR files and DevTools network data are processed in your browser’s memory on your own device. They are not uploaded, synced, or sent to any server, including ours. Captured traffic is held in memory only while the DevTools panel is in use and is not written to storage by the extension. Sanitized files are saved only when you click a download button, and only to a location you choose.
What is stored on your device
HAR Sanitizer uses your browser’s local extension storage (chrome.storage.local) to remember your preferences: your chosen preset and over-redaction level, placeholder style, custom rules (including any “always redact” text, “keep” values, and custom patterns you enter), per-site profiles, and the DevTools memory limit. This data stays on your device. It is not sent to us or anyone else, and you can erase it by using “Reset settings” in the extension or by uninstalling the extension.
Please note that custom rule values you type are stored exactly as entered, so avoid entering real secrets as keep or always-redact values if others share your computer.
Optional encrypted mapping file
If you choose to save a mapping file so that you can later restore original values, it is encrypted on your device (AES-256-GCM with a key derived from your passphrase using PBKDF2) and saved only where you choose. We cannot read it and cannot recover your passphrase. If you lose the passphrase, the originals cannot be restored.
Network access
The extension is built with a content security policy that blocks network requests from its pages. Its “Prove it’s local” page intentionally attempts a single request to a public website to demonstrate that the browser blocks it. No data is sent in that attempt.
Permissions
- storage: to save your settings locally, as described above.
- DevTools panel: uses Chrome’s standard DevTools network API to read requests while the panel is open, only for the tab you are inspecting. This requires no additional permission.
The extension does not request access to websites, tabs, history, or downloads of your browsing data.
Third parties
We do not sell or transfer user data to third parties, and we do not use or transfer user data for purposes unrelated to the extension’s single purpose, nor to determine creditworthiness or for lending. The extension includes one bundled open-source library (fflate, for creating ZIP and gzip files) that runs locally and makes no network requests.
Children’s privacy
The extension does not collect personal information from anyone, including children.
Limits of the tool
HAR Sanitizer reduces the risk of sharing sensitive data but cannot guarantee that every secret is found. Please review sanitized files before sharing them.
Changes to this policy
If we ever change how the extension handles data, we will update this page and the “last updated” date, and the extension’s store listing will be updated to match before any change takes effect.
Contact
Send Us An Email Here