HAR File Sanitizer - Remove Cookies & Tokens Before Sharing

Strips session cookies, bearer tokens, API keys, secret query parameters and form passwords out of HAR files, so you can attach them to a support ticket without leaking a login. You also get a change log and a quick performance and third-party summary.

Made for support engineers, QA teams, SaaS vendors and AI agents that receive HAR files from customers. It runs offline on the JSON: no browser, no proxy, nothing is sent to a third party.

Input examples

Clean a file from a link:

{ "harUrls": ["https://example.com/uploads/customer-session.har"] }

Clean a pasted HAR and also remove all response bodies (smallest, safest file):

{ "harJson": "{\"log\":{\"entries\":[]}}", "dropResponseBodies": true }

Clean every HAR in a key-value store, keep IP addresses, treat two extra headers as secret:

{ "keyValueStoreId": "YOUR_STORE_ID", "redactIps": false, "extraSensitiveNames": ["x-tenant-secret", "x-customer-id"] }

Leave the input empty to see a demo on a built-in HAR with fake secrets.

Input guide

Field	What it does
harUrls, harJson, keyValueStoreId + recordKeys	Where the HAR files come from. Mix as you like.
redactCookies, redactAuthHeaders, redactQueryParams, redactBodies	On by default. Each switch controls one family of redactions.
redactPii	Emails, Luhn-valid card numbers, US SSNs and fields called email, phone, address and similar.
redactIps	Replaces serverIPAddress and client IP fields. Off by default.
dropResponseBodies	Deletes response body text completely.
extraSensitiveNames	Your own header, query, form or JSON names to always redact.
firstPartyDomains	Which domains are "yours" in the third-party summary. Default: domain of the first HTML document.

Output

One dataset row per HAR, plus two files in the run's key-value store: the cleaned HAR (sanitized-N-name.har) and a change log (changelog-N-name.json). Both have a link in the row.

Field	Meaning
entries	Number of requests in the HAR
redactions, byCategory	How many values were replaced, by family (cookie, auth-header, query-secret, body-secret, secret-field, pii, token, api-key)
sanitizedHarUrl, changeLogUrl	Links to the cleaned file and the change log
performance	Requests, transfer, load timings, status classes, types, slowest and largest requests
thirdParties	Third-party domains with category guess, request count, bytes, and whether they set cookies

Sample row (shortened):

{ "type": "har", "name": "demo-har", "entries": 8, "redactions": 23,
  "byCategory": { "cookie": 7, "auth-header": 2, "query-secret": 1, "body-secret": 5, "pii": 5 },
  "sanitizedHarUrl": "https://api.apify.com/v2/key-value-stores/.../records/sanitized-1-demo-har.har",
  "thirdParties": { "domains": 3, "requests": 3, "sharePctOfRequests": 38 } }

The change log lists where each redaction happened (entry number, host and path, field, rule). It never contains the secret values.

Use it with

• A support form or ticket webhook: send the uploaded HAR URL, attach the cleaned file instead.
• An AI agent that triages bug reports: call the Actor through the API or MCP and read sanitizedHarUrl.
• Website Content Crawler or any Actor that stores HAR files in a key-value store: point keyValueStoreId at it.

FAQ

Is the result guaranteed secret-free? No. The rules cover the common shapes (see limits). Always glance at the change log and search the output for anything specific to your product before sharing outside your company.

Does it change the timings? No. Only strings are replaced. Sizes, timings and structure stay the same, so the file still loads in Chrome DevTools.

Are bodies in base64 checked? No. Binary bodies are counted in binaryBodiesNotScanned; use dropResponseBodies if they might hold secrets.

Honest limits

• Rule-based, not a guarantee. Secrets with unusual names inside free-text bodies, or custom token formats, may survive: add them to extraSensitiveNames or use dropResponseBodies.
• state, code and key query parameters are redacted on purpose, which can hide harmless values.
• Third-party categories come from a small built-in domain list; unknown domains are other.
• Files are held in memory (default limit 60 MB).

Price

Pay per event: $0.005 per HAR file sanitized (har-sanitized). Cleaning 100 HAR files costs $0.50. Files that fail to parse are not charged.