Privacy tool

HAR File Sanitizer

Strip session cookies, bearer tokens and response bodies from a HAR file before you send it to support. Free, private, processed in memory.

HAR HAR
PrivConvert
Privacy-first conversion
No files stored
In-memory processing
Deleted instantly
No sign-up needed

Complete the security check to begin

The file support asked for is the file you should not send

"Send me a HAR and I'll take a look" is a reasonable request, and exporting one takes ten seconds. What is easy to miss is that the export is not a log of what went wrong — it is a recording of everything that went right too, including the credentials that made it work. The cookie that keeps you signed in is in there. So is the bearer token, the API key in the query string, and the body of the login response that issued them.

Once that file is attached to a ticket it lives wherever tickets live: a helpdesk database, an email thread, a vendor's cloud. It stays valid for as long as the session does. This tool removes the parts that can be replayed and leaves the parts that explain the failure.

  • Header values allowlisted: an unrecognised header cannot leak, whatever it is called
  • Credentials removed from cookies, URLs, paths, request bodies and WebSocket frames
  • JWTs caught by their shape, not just by the field they were found in
  • Response bodies dropped entirely — the largest and most sensitive part
  • URLs, statuses, header names, sizes and timings kept, so it is still debuggable
  • Valid HAR 1.2 out, ready to open in DevTools

Want the request log as a spreadsheet instead? HAR to CSV turns the same capture into one row per request.

Why choose PrivConvert?

PrivConvert processes your file entirely in memory and forgets it the moment you have your result. Here is what that means in practice:

Zero data retention

Files are processed in volatile memory (RAM) and purged the instant your download is ready — nothing is ever written to disk, cached or backed up.

Encrypted transfers

Every upload and download is protected with TLS 1.3, so your file cannot be intercepted on the way to the server or back to you.

No account required

Convert instantly with no sign-up, no email and no profiling cookies. We never build a profile around you or the files you convert.

Works on any device

Runs in any modern browser on Windows, macOS, Linux, Android and iOS — no install, plugin or desktop software needed.

Built for people who value their privacy

PrivConvert handles thousands of conversions every day for developers, designers and privacy-conscious people who need a file converted without handing over a permanent copy.

250 MB Max file size
450+ Conversion tools
0 sec File retention
100% Free to use

Frequently Asked Questions

Why does a HAR file need sanitizing at all?
Because it is a complete recording of your session, not a summary. Every request it captured includes the headers that were sent, which means your live session cookies and any Authorization: Bearer token are written into the file in plain text. Anyone who opens it can replay those and act as you, without needing your password.
Has that actually caused a breach?
Yes, famously. In October 2023 an attacker reached Okta's customer support system and read HAR files that customers had uploaded to their tickets. The session tokens inside were used to reach those customers' own environments — Cloudflare, 1Password and BeyondTrust all reported follow-on activity. The files were uploaded by careful engineers doing exactly what support asked.
What exactly gets removed?
All cookie values, every response body, recorded WebSocket payloads, free-text comment fields, any query or form parameter whose name suggests a secret, credentials embedded anywhere in a URL — the query, the fragment, the userinfo and even a session id placed in the path — and the value of any header that is not a recognised standard one. Anything shaped like a JWT is removed wherever it appears.
Why redact headers you do not recognise instead of the dangerous ones?
Because a list of dangerous headers can only ever contain the ones somebody thought of, and an application is free to invent 'X-Sid: <your session>'. So the rule is inverted: the standard vocabulary of HTTP — content types, caching, CORS, client hints, security policy, and the tracing headers used to match a capture to a server log — keeps its values, and everything else keeps its name but loses its value. A custom header being blanked is the expected outcome, not a bug.
What survives, and is the file still useful?
Yes — that is the point. URLs and their harmless parameters, request methods, status codes, every header name, cookie names and their flags, content types, sizes, timings and the order of requests all stay. A support engineer can still see which call failed, how long it took, what type of response came back and how the browser was told to cache it. They just cannot log in as you.
Why are all response bodies deleted rather than filtered?
Two reasons. They are where a freshly issued access token usually appears, in the response to the login call, and they are where other people's personal data appears. They are also most of the file's size. Since we cannot reliably tell a safe body from a dangerous one, they all go and the size and content type stay behind so you can still see what was returned.
Can it miss something?
It can, and it would be dishonest to claim otherwise. Headers are handled by allowlist so an unknown one cannot leak, but query parameters and JSON request bodies have no fixed vocabulary to allow — a token sitting under a key called "data" looks exactly like data. Every rule here deliberately over-matches rather than under-matches, and a needlessly blanked value costs one question while a missed one costs an account. Even so, glance over the result before you send it.
Is the file uploaded anywhere or kept?
It is processed in server memory and returned to you. It is never written to disk, never stored, never logged and is gone as soon as your download completes. Given what a raw HAR contains, that guarantee is the reason this tool exists here rather than as a service that keeps a copy.
Will the cleaned file still open in a HAR viewer?
Yes. The output is valid HAR 1.2 and opens in Chrome DevTools, Firefox, the Google HAR Analyzer and the usual command line tools. A note is added to the log comment recording that it was sanitized, so whoever receives it knows why the bodies are missing.
How do I create a HAR file in the first place?
Open your browser's developer tools, go to the Network tab, tick 'Preserve log', reproduce the problem, then right-click the request list and choose 'Save all as HAR'. Chrome, Edge, Firefox and Safari all offer this.
Can I run this automatically?
Yes. It is a plain HTTP endpoint and part of the developer API, so a support desk or CI job can sanitize every HAR on arrival rather than trusting each person to remember.

Related Tools

Remove EXIF Protect PDF Password Generator Compress Image

Further Reading

Your HAR File Contains Your Session Token The Privacy Checklist for Online File Conversion