How to create a HAR file in Chrome without leaking your tokens

TL;DR: Open DevTools > Network, check Preserve log and Disable cache, clear, reload, reproduce the bug, then click Export HAR (sanitized).... Since Chrome 130 that export drops Cookie, Set-Cookie and Authorization. Tokens in URLs, custom headers like X-Api-Key, and request and response bodies are still in the file. Run a grep over it before you attach it to a ticket.

Every support team eventually asks for "a HAR file". Most of the bad ones I've seen came from the same three mistakes: DevTools opened too late, Preserve log off, or a filter left on. Here's the version that works on the first try.

The steps

1. Go to the page with the problem and open DevTools (F12, Ctrl+Shift+I, or Cmd+Option+I on macOS). Click Network. Do this before you reproduce anything, because Chrome only logs requests while DevTools is open.
2. Check Preserve log (so redirects and logins don't wipe the list) and Disable cache (so you see what a first-time visitor sees).
3. Click the clear button, then reload. Now the log starts from a clean page load.
4. Reproduce the bug. Keep DevTools open until it has happened.
5. Clear the Filter box and select All. A leftover Fetch/XHR chip is an easy way to ship half a file.
6. Click the download icon, Export HAR (sanitized)..., and save. Right-clicking any request gives you Save all as HAR (sanitized) too.

If the flow opens a popup or a new tab (hello, SSO), those requests land in that tab's DevTools. Turn on Auto-open DevTools for popups in DevTools settings first.

"Sanitized" covers three headers

Chrome 130 changed the default export (release notes). The sanitized file leaves out:

• Cookie
• Set-Cookie
• Authorization

That's the whole list. If you actually need those headers, say to debug your own auth flow, go to DevTools Settings > Preferences > Network, check Allow to generate HAR with sensitive data, then long-click the Export button and pick Export HAR (with sensitive data).

Edge behaves the same since it's the same DevTools. Firefox (Network Monitor gear menu > Persist Logs, then Save All As HAR) and Safari (Web Inspector > Network > Preserve Log, then Export) put cookies and auth headers in the file along with everything else.

What's still in a sanitized HAR

Things I've found in "sanitized" HAR files:

• X-Api-Key, X-CSRF-Token, X-Auth-Token headers
• ?access_token=... and ?api_key=... in URLs, including inside Referer and Location
• OAuth ?code= values on the login redirect
• The password in a login request body, in plain text
• Refresh tokens in token-exchange calls and fresh access tokens in login responses
• Names, emails and addresses in ordinary API responses

Scrubbing it

First, record less. Log in, clear the log, then reproduce only the failing steps.

Then strip the headers you know about. With jq:

jq '.log.entries[] |= (
  .request.headers |= map(select(.name | test("^(cookie|authorization|x-api-key)$"; "i") | not))
  | .response.headers |= map(select(.name | test("^set-cookie$"; "i") | not))
  | .request.cookies = []
  | .response.cookies = []
)' session.har > session.scrubbed.har

Headers are the easy part. Now look for everything else:

grep -n -i -E 'token|secret|password|api[_-]?key|bearer|eyJ' session.scrubbed.har

eyJ catches JWTs, because {" base64-encodes to eyJ. Every hit is a value to replace by hand or a step to leave out of the recording. Google's HAR Analyzer can also download a redacted copy. Whatever you couldn't remove, log out or rotate the key once the ticket is closed.

A sanitizer that also reads URLs and bodies

I work on Netraptor, a Chrome extension that adds its own Network panel to DevTools, and its Save all as HAR (sanitized) goes further than Chrome's. It drops any header with a credential-like name (token, secret, password, session, auth, csrf, jwt, key, and so on), sets matching query and fragment params plus OAuth code to [redacted], redacts matching keys at any depth in JSON and form bodies, and removes bodies it can't parse (HTML, text, binary) with a comment saying so. It saves only the rows you have filtered to, so you can export just the failing calls. It matches on field names, so an email under email or a token in a URL path still gets through. Run the grep anyway.

The full guide, with FAQ and a section on why HAR files come out empty, is here: How to create a HAR file in Chrome.