Question 1

What is a HAR (HTTP Archive) file, and why is sharing it risky?

Accepted Answer

A HAR (HTTP Archive) file is a standard JSON-formatted log containing comprehensive records of HTTP/HTTPS communications between a browser and servers:

① Contains Highly Sensitive Credentials:
HAR files faithfully record `Authorization` headers (Bearer tokens, Basic auth), session `Cookie` / `Set-Cookie` identifiers, API keys, and request/response payloads.

② Account Takeover Risk:
If an un-sanitized HAR is shared with support desks, posted on GitHub, or shared with vendors, attackers can extract session cookies or tokens to replay requests and hijack active user sessions without credentials.

Question 2

How does this tool sanitize HAR files? Is my data uploaded anywhere?

Accepted Answer

100% Private & Safe! This tool operates entirely on a Zero-Server client-side architecture:

① In-Memory Local Processing:
All JSON parsing, regex pattern matching, field scrubbing, and file generation execute strictly inside your local browser memory.

② Zero Network Transmission:
Your archive contents are never transmitted to any remote servers, cloud endpoints, or third-party telemetry services. It works seamlessly even when offline.

Question 3

What is "Media Stripping" and how does it reduce file size?

Accepted Answer

Media Stripping is a powerful feature designed to tackle bloated HAR archives:

① Solves Huge File Sizes:
When recording web sessions, browsers serialize images (PNG, JPEG, WebP), fonts (WOFF2), and binary assets into massive Base64 strings inside Response Bodies, inflating files to 30MB-100MB+.

② Retains Critical Diagnostics while Slashing File Size:
Enabling this option strips heavy Base64 media data while perfectly preserving HTTP status codes, network timing, request/response headers, and JSON API payloads—typically shrinking the file by over 90% (<1MB).

Question 4

Which sensitive patterns and fields are automatically sanitized?

Accepted Answer

The engine features multi-tier automated detection:

① Authentication & Headers:
Redacts `Authorization`, `Proxy-Authorization`, `X-Api-Key`, `X-Auth-Token`, `Bearer`, `Cookie`, `Set-Cookie`, and session identifiers.

② URL & Form Keys:
Intercepts `token`, `access_token`, `auth`, `api_key`, `secret`, `password`, `code`, `session_id`, and `refresh_token`.

③ Deep Regex Detection:
Detects and masks JWT signatures (`eyJ...`), AWS Access Keys (`AKIA...`), Stripe keys (`sk_live_...`), emails, and RSA/OpenSSH private keys.

Question 5

Can the cleaned HAR file be re-imported into Chrome DevTools or Postman?

Accepted Answer

Fully Compatible! The tool strictly adheres to the W3C HAR 1.2 specification:

① Preserves JSON Integrity:
Sanitization modifies sensitive string values (e.g. replacing them with `[REDACTED]`) without altering object hierarchies, timestamps, or required structure.

② Seamless Multi-Tool Support:
Exported `.har` files can be immediately dragged back into Chrome DevTools Network tab, Charles Proxy, Wireshark, Postman, Fiddler, or Datadog for continued troubleshooting.

Question 6

How can I add custom sensitive fields specific to my company or app?

Accepted Answer

You can easily configure custom rules:

① Custom Keywords List:
Enter field names (comma or newline separated) such as `customer_ssn, internal_org_id, pay_secret`.

② Global Automatic Matching:
The scrubber will automatically redact these keys across Request Headers, Query parameters, POST form bodies, and nested JSON objects.

Question 7

What does the "Tracker Filter" option do?

Accepted Answer

Eliminates telemetry noise:

① Removes Third-Party Analytics Requests:
Recorded browser sessions often contain dozens of tracking beacons from Google Analytics, Facebook Pixel, Hotjar, Sentry, Datadog, etc.

② Focuses on Core APIs:
Enabling this filter purges these irrelevant telemetry requests so you can focus purely on your application's primary endpoints.

Question 8

How can I quickly try out and test this tool?

Accepted Answer

One-Click Sample Experience:

① Click "Load Sample HAR File":
The tool will immediately load a realistic sample HAR containing JWTs, auth cookies, sensitive query params, and image payloads.

② Real-time Inspection:
Toggle cleaning rules, view entry diffs, and observe instant file size reduction and sanitization statistics.

HAR Sensitive Data Sanitizer

Drag and drop a HAR file here, or click to browse

Sanitization & Cleaning Configuration

Frequently Asked Questions (FAQ)8 Q&As