Guides · HAR files and network logs
How to share a HAR file safely
Updated Sep 23, 2026
Before you send a HAR file, remove cookies, Authorization headers, tokens in URLs and query strings, and personal data in request and response bodies. Chrome 130+ drops cookie and Authorization headers by default, but it does not touch bodies or URLs, so check those yourself.
What a HAR file can leak
| Where | Example | Removed by Chrome 130+ default export? |
|---|---|---|
| Cookie / Set-Cookie headers | session=eyJhbGci… | Yes |
| Authorization header | Bearer sk_live_… | Yes |
| Custom auth headers | X-API-Key, X-Auth-Token | No |
| URLs and query strings | ?token=…, ?email=…, magic-link codes | No |
| Request bodies | login JSON with a password, form posts | No |
| Response bodies | your profile, addresses, other users' data in lists | No |
Checklist before you send it
- Record only what's needed. Clear the Network panel right before you reproduce the problem, and stop right after. Fewer requests, less exposure.
- Don't log in during the recording unless login is the bug. That keeps your password out of the request bodies.
- Keep the default sanitized export. Only use "Export HAR (with sensitive data)" if support explicitly needs cookies.
- Search the file. It's JSON, so open it in a text editor and search for
password,token,key,secret,session, and your email. Replace values withREDACTED. - Send it privately, to the person who asked, then delete your copy when the ticket closes.
- Log out afterwards if you think a session token slipped through. That kills it.
Capture less in the first place
The safest HAR is one that never held the secret. Roll redacts before it stores anything: Authorization, cookie and API-key headers are dropped at capture, password, card and one-time-code fields are never recorded, and streaming responses are never read. Recordings stay on your machine until you choose to publish a link, and free links delete themselves after 7 days.
That doesn't make response bodies harmless. If the page shows personal data, the recording contains it, the same as a HAR. Review before you share either one. Details on what Roll records.
Next steps
New to HAR files? Start with how to export a HAR file from Chrome. Sending a bug to a developer rather than a support team? A recording with the network log is often clearer than a HAR on its own.
Questions
Is it safe to send a HAR file to support?
Usually, if you check it first and send it only to the vendor that asked for it, through their support channel. Don't post it in a public forum or GitHub issue. Anyone holding a live session cookie or token from it can act as you until that session expires.
Does Chrome's sanitized HAR remove everything sensitive?
No. It removes Cookie, Set-Cookie and Authorization headers. Request bodies, response bodies, query strings, custom auth headers like X-API-Key, and tokens in URLs are all still there.
What should I do if I shared a HAR with a live session in it?
Log out of the site everywhere, or change your password. Either usually invalidates the session tokens in the file. Rotate any API key that appears in it.