How to create a HAR file in Chrome, and remove tokens before you share it

Since Chrome 130, the default HAR export is sanitized. It leaves out three headers: Cookie, Set-Cookie and Authorization. Everything else is kept, including query strings, request bodies and response bodies.

For a support ticket, the sanitized file is almost always what you want. The person reading it needs URLs, status codes, timings and error responses, and the sanitized file has all of them. Send the version with sensitive data only when someone is debugging the auth flow itself and asks for it.

To get that version, open DevTools Settings (the gear icon or F1), go to Preferences > Network and check Allow to generate HAR with sensitive data. The Export button then shows a small arrow. Long-click it and choose Export HAR (with sensitive data). The Network features reference has the current labels.

Most bad HAR files come from one of these:

• DevTools was opened after the problem happened. Chrome does not log in the background, so the requests you needed were never recorded. Open DevTools, then reproduce.
• Preserve log was off. A redirect or login cleared the list, and the file only holds the last page.
• A filter was still set. If the Filter box has text in it or a type like Fetch/XHR is selected, clear it before exporting so the file includes every request.
• The flow opened a popup or a new tab, as many single sign-on logins do. Those requests show up in that tab's own DevTools. Turn on Auto-open DevTools for popups in DevTools Settings, or open DevTools in the new tab before you continue.
• The cache answered. Without Disable cache, files the browser already has never reach the network again, so the timings don't match what a first-time visitor sees.

• Microsoft Edge runs the same DevTools as Chrome. The steps and labels above apply as written.
• Firefox: open the Network Monitor with Ctrl+Shift+E or Cmd+Option+E. Check Disable Cache in the toolbar, and turn on Persist Logs from the gear menu at the right of the toolbar. Reproduce the issue, then choose Save All As HAR from the same menu. See the Firefox Network Monitor toolbar docs.
• Safari: turn on Show Develop menu in Safari Settings > Advanced, then choose Develop > Show Web Inspector. In the Network tab, turn on Preserve Log, reproduce the issue and click Export.

Firefox and Safari write cookies and Authorization headers into the file along with everything else, so the cleanup steps below matter even more there.

A HAR file records the request and response of every call, so it carries whatever credentials the app sends. Chrome's sanitized export only covers the first item on this list:

• Cookies and auth headers: Cookie, Set-Cookie and Authorization: Bearer .... Chrome removes these by default. Firefox and Safari keep them.
• Custom headers: X-Api-Key, X-CSRF-Token, X-Auth-Token and similar. Chrome keeps them in a sanitized export.
• Tokens in URLs: ?access_token=, ?api_key=, OAuth ?code= values on redirects, signed URL signatures and magic-link tokens. They appear in the request URL, the queryString list, Referer and Location headers.
• Request bodies: a login request holds the password in plain text, and token refresh calls carry the refresh token.
• Response bodies: login responses often return new access tokens, and most API responses contain personal data such as names, emails and addresses.

If you have a JWT in the file and want to see what it reveals, decode it locally in Chrome instead of pasting it into a website.

Start by recording less. Log in first, then clear the log and reproduce only the failing steps. A short file has fewer secrets to find and is easier for support to read.

Then remove what you can. Google's HAR Analyzer can download a redacted copy of a file. If you have jq installed, this command drops cookie, auth and API key headers and empties the cookie lists:

jq '.log.entries[] |= (
  .request.headers |= map(select(.name | test("^(cookie|authorization|x-api-key)$"; "i") | not))
  | .response.headers |= map(select(.name | test("^set-cookie$"; "i") | not))
  | .request.cookies = []
  | .response.cookies = []
)' session.har > session.scrubbed.har

Headers are the easy part. Tokens in URLs and bodies are still there, so search the result before you send it:

grep -n -i -E 'token|secret|password|api[_-]?key|bearer|eyJ' session.scrubbed.har

Every line this prints is something to check. Replace the value with a placeholder in a text editor, or record again without the step that produced it. Tokens you could not remove expire if you log out or rotate the key after support is done.

Chrome's sanitized export stops at three headers. Netraptor, a free Chrome extension, adds its own Network panel to DevTools with a HAR export that also cleans URLs and bodies. It records the inspected tab as soon as you open the Netraptor panel and keeps requests across reloads and redirects, so there is no Preserve log to forget.

To save a HAR file, right-click any request in Netraptor's Requests tab and choose Save all as HAR (sanitized). It saves the rows currently listed, so your filter, the type chips and Hide noise all apply. Filter to the failing calls first and the file stays small. The sanitized file:

• Drops every request and response header with a credential-like name: Authorization, Proxy-Authorization, Cookie, Set-Cookie, and any name containing token, secret, password, session, auth, csrf, xsrf, jwt, bearer, signature, credential or key, which covers X-Api-Key and X-CSRF-Token.
• Replaces matching query and fragment parameters with [redacted], plus OAuth code values. This applies to the request URL and to Referer, Location and initiator URLs.
• Redacts matching fields at any depth in JSON request and response bodies, and in form-encoded request bodies.
• Removes bodies it cannot parse, such as HTML, plain text and binary data, and marks them Removed by Netraptor sanitized export.

When you need the unsanitized file for your own debugging, use Copy > Copy all as HAR in the same right-click menu, which copies the listed requests to the clipboard. Or open the Export tab, pick HAR and uncheck Strip auth headers and cookies. The Export tab exports the whole session, and that checkbox runs the same sanitizer when it is on, which is the default.

Two limits worth knowing. Netraptor keeps each body up to 1 MB and marks larger ones as truncated. It stores API response bodies as they arrive, but script and stylesheet bodies only once you open them. For a full page-load waterfall with every asset body, Chrome's own export is the better file. HAR export is on the Free plan and the data stays in your browser.

To read the file yourself, import it back into the Network panel, open it in a viewer or query it with jq. See how to open and analyze a HAR file. For background on the format and what each field means, see what a HAR file is.