Clean your HAR

A HAR file you recorded yourself contains not only evidence but also your own data: cookie values, login tokens, your IP address, sometimes your name and email. Before you send it to a company, a regulator or anyone else, it needs to be cleaned.

This page cleans the file using the same rules we apply before publishing a HAR (see “HAR sanitisation” in the methodology). The result matches our script byte for byte: the same source file gives the same SHA-256 checksum.

The file is not uploaded to a server. Cleaning happens right in your browser — the file is not sent anywhere, and we neither see nor store it. You can check this in the Network tab of the developer tools: choosing a file triggers no requests.

What is removed and what stays

Removed: cookie values; authorisation headers and tokens; sensitive URL parameters (token, session, email, phone, code and similar — the value is stripped, the name stays); your IP address; request and response bodies that are not evidence (their size and type are kept instead); personal fields inside small responses from ad systems (identifiers, user agent, email, coordinates); passwords in URLs and paths to folders on your computer.

Kept: who received requests, when and in what order; cookie names and attributes; which script triggered a request; the recipient servers’ addresses; small responses from ad exchanges and consent strings (TC string) — everything that proves data was transferred.

Along with the file you get a redaction map — a list of what was removed and where — and the SHA-256 checksum of the cleaned file. You can quote it in your letter so the recipient can confirm the file has not been altered.

After cleaning, the page shows a report: which of your data was in the file — cookies, tokens, IP address, personal fields — and which domains it went to. Values are hidden by default, and the report itself exists only in this tab and is not saved anywhere.

Important

Automatic cleaning cannot guarantee completeness. If you were logged in to the site while recording, your name, email or order number may remain in server responses, in fields that are not on our list. The safest way is to record the HAR in a private window without logging in.

After cleaning, the page checks the file and shows anything suspicious it finds. Still, look through the file yourself before sending it — for example, search it for your name and email. Keep the original file: with it you can always show that the cleaned copy was made from it.