Network & DNS
Free HAR File Sanitizer & Sensitive Data Scanner
Sanitize browser HAR files locally. Detect and remove session cookies, bearer tokens, API keys, credentials, and query params with a full risk report.
Results
What the result means
An HTTP Archive (HAR 1.2) records raw network transactions between your browser and servers, including request URLs, cookies, authorization tokens, POST payloads, and full response bodies. While Chrome DevTools provides an export option to strip cookies and basic Authorization headers, it leaves sensitive query parameters, Set-Cookie response headers, OAuth refresh tokens, and customer data in request and response bodies completely exposed. PageUtil HAR File Sanitizer scans the archive locally in your browser to detect credentials, API keys, session tokens, and personal information across every header, query parameter, and payload. It generates an itemized risk report and exports a clean, sanitized archive. You can also strip all payloads entirely to debug latency waterfalls safely without leaking data.
The table below contrasts standard browser HAR exports with PageUtil's client-side sanitizer:
| Data Location | Chrome DevTools Default | Chrome 'Sanitized' Export | PageUtil HAR Sanitizer |
|---|---|---|---|
Authorization header | Exposed (Bearer/Basic tokens) | Stripped | Redacted with credential type audit |
Cookie request headers | Exposed (active sessions) | Stripped | Redacted or masked per cookie key |
Set-Cookie response headers | Exposed (new session IDs) | Exposed | Redacted to prevent session hijacking |
Sensitive query params (?token=) | Exposed in request URLs | Exposed in request URLs | Scrubbed from URLs & queryString array |
| POST form data & JSON bodies | Exposed (passwords, secrets) | Exposed (passwords, secrets) | Redacts secret fields or strips entirely |
| Response bodies (user PII, APIs) | Exposed (profile data, tokens) | Exposed (profile data, tokens) | Scrubbed for PII/tokens or body stripped |
| Performance & network timings | Intact | Intact | 100% preserved (DNS, SSL, TTFB timings) |
Related tools
Guides
Questions
What sensitive information does a browser HAR file contain?
A HAR file records full HTTP sessions. This includes Authorization headers (Bearer tokens, Basic auth), session cookies (connect.sid, PHPSESSID, JWTs), Set-Cookie headers in responses, sensitive query parameters (?token=, ?api_key=), request bodies (passwords, OAuth client secrets), and response bodies (customer PII, API tokens, internal endpoints).
Why is Chrome's built-in 'Sanitized HAR' export insufficient for sharing?
Chrome DevTools sanitized export only omits select request headers such as Cookie and Authorization. It does not sanitize Set-Cookie response headers, tokens embedded in URL query parameters, passwords in POST bodies, or private customer records returned in JSON response bodies.
How does 'Strip all bodies' mode help with performance and latency debugging?
When troubleshooting CDN cache misses, 502/504 errors, DNS lookups, or SSL handshake latency, support engineers need connection timings (blocked, dns, connect, ssl, send, wait, receive), not payload contents. Stripping bodies eliminates all confidential customer data while preserving 100% of the timing metrics.
Are my HAR files uploaded to PageUtil or any cloud service?
No. All HAR parsing, secret scanning, and redactions occur entirely inside your browser's memory using JavaScript and Web Workers. Your network traffic logs and credentials never leave your local device.
What types of API keys and secrets does the risk scanner detect?
The scanner identifies Bearer tokens, JSON Web Tokens (JWT), AWS Access Key IDs, GitHub Personal Access Tokens, Stripe secret and restricted keys, Google API keys, Slack tokens, private key blocks, email addresses, phone numbers, and Luhn-validated credit card numbers.