A HAR file carries your cookies, tokens and sometimes passwords. Load it here, choose what to redact and download a copy that is safe to attach to a support ticket — the requests, timings and structure stay intact.
The HAR file is processed in your browser and never uploaded — the point is that your secrets stay with you.
A HAR file is a complete recording of a page load, made for debugging. It records the headers and often the bodies of every request — which means it also records whatever proved who you were. Support teams ask for HAR files all the time, and they are routinely pasted into tickets and chats where many people can read them.
The Cookie and Set-Cookie headers hold the session that keeps you logged in. With it, someone else can be you on that site until it expires.
Bearer tokens, API keys and basic-auth credentials sent to APIs — often long-lived and with wide access.
OAuth codes, signed-URL signatures, api_key= and token= parameters end up in the request URL and the query string list.
A login recorded in the HAR contains the password in its request body, in plain text, however secure the connection was.
The file is parsed in your browser, values are replaced with [REDACTED] and the result is written back as a valid HAR. Names, URLs, status codes, sizes and timings stay as they were, so the file is still useful for debugging — the person analysing it can see which request failed and why, just not your credentials.
Authorization, Proxy-Authorization, X-API-Key and any header ending in -token, -secret or -api-key.token, access_token, api_key, password, secret, signature, code, session and similar.No automatic filter knows every secret format. Look through the output before you share it, especially response bodies, which can hold personal data. Ticking "All response bodies" removes them entirely.
Not as exported. It contains session cookies and authorization headers that can let someone act as you, and sometimes passwords from login forms. Sanitize it first and share it only with people who need it.
No. Everything happens in JavaScript in this page; the file never leaves your computer. You can disconnect from the network after the page has loaded and it still works.
Yes. Only values are replaced; the structure, URLs, status codes and timings stay valid, so Chrome, Firefox and HAR viewers open it as usual.
It is good practice. Logging out ends the session in the cookies that were recorded, so even a copy that was not sanitized stops working.
Upzilla checks your sites, servers and APIs around the clock and alerts you the moment something breaks. 10 monitors free, no card required.