quietutilsAll tools

HAR sanitizer

Keep only the requests support needs, remove unnecessary fields, and inspect the exact HAR you will share.

Your inputs stay in this tab. Processing runs locally; nothing is uploaded or saved to browser storage.

Requests to include

Choose a HAR to select requests.

All header values, query parameters, cookies, request and response bodies, redirects, page titles, comments, and extension fields are removed. Method, origin/path, status and timings remain.

Nothing processed yet.

Exact outgoing HAR

No output yet.

How to sanitize a HAR file before sharing it

A HAR file records browser requests and responses for debugging. This HAR sanitizer creates a smaller support bundle from the requests you select. It removes whole fields instead of trying to guess which individual values are secrets.

  1. Choose a HAR 1.2 file, up to 20 MB and 10,000 requests.
  2. Keep the failed-request filter for HTTP errors or status 0. Uncheck it when support needs successful requests too. Optionally narrow the UTC time window.
  3. Uncheck requests unrelated to the incident, then select Build outgoing HAR.
  4. Read the exact outgoing preview and removal summary before downloading. Check hostnames and paths for identifiers that should not be shared.

What gets removed, and what remains?

Headers, cookies, query parameters, URL credentials, fragments, request bodies and response bodies are removed. The export retains request origins and paths, methods, status codes, timestamps, content sizes and timings. Removing diagnostic details can make some issues harder to reproduce; agree with support on what they actually need.

Does sanitizing a HAR remove every secret?

No. A path such as /customers/example-person/orders can still identify someone after cookies and query parameters are gone. Exclude that request if it is unnecessary, or review and edit the export before sharing. This tool does not certify an export as anonymous.

For a token-specific investigation, use the JWT decoder or JWT header and claims checker. To inspect the exported structure, use the JSON formatter.

What this does not prove

Paths, hostnames, timestamps, methods and status text can still identify people or systems. Review the entire preview. This is a minimized diagnostic export, not a guarantee that every secret has been removed. HAR 1.2 with HTTP(S) request URLs only.