Remove auth headers with HAR Desk
This opens a made-up login capture with a Bearer token, a session cookie, a CSRF value and a password in the form body. The standard policy is already selected: press Sanitize to see each value replaced and every change listed.
- Load your HAR (or keep the sample) and open the Sanitize tab.
- Look at the policy: Authorization, API-key, token and secret headers are always replaced, and the cookie option controls Cookie and Set-Cookie values.
- Press Sanitize and read the list of changed fields, with the original and the placeholder side by side.
- Read the limitations, tick the review box, then download the sanitized .har and open it in DevTools to check it.
What to know
The values that most often leak from a HAR are in headers: Authorization (Bearer, Basic or Token credentials), X-API-Key style headers, Cookie and Set-Cookie. The sanitizer replaces the value of every header whose name matches its list, keeps the scheme word (Bearer) so you can still see what kind of credential it was, and replaces it with a placeholder such as [REDACTED:header:authorization_4].
The number in the placeholder identifies the value, not its content: the same token gets the same number everywhere in the file, so a support engineer can see that one session was reused across requests, but the number is a counter and cannot be turned back into the secret. Referer, Origin and Location headers are treated as URLs, so tokens in their query strings go too.
This lowers the risk; it does not remove it. Header names are never changed, a secret in a header you did not name or an unusual place is not known to the tool, and free-text values only get pattern detectors. Add your own header names under Your rules, read the limitations list, and look through the downloaded file before you send it.
Updated · Cosmovex
Questions
Which headers does it replace by default?
Authorization, Proxy-Authorization, X-API-Key, X-Auth-Token, X-Access-Token, CSRF and XSRF tokens, session ids, cloud security tokens, and any header whose name contains token, secret, password, api-key or apikey. The Sanitize tab lists them all.
Does it handle Cookie and Set-Cookie differently?
Yes. Their values follow the cookie setting: replace every cookie value, only sensitive-looking names, or none. Set-Cookie attributes such as Path and HttpOnly stay, so the cookie is still readable as a cookie.
Will the sanitized file still open in Chrome DevTools?
The structure is kept: the same fields, only values change, and the tool warns if the output has more HAR 1.2 structure issues than the input. Import it in DevTools (Network, Import HAR) to confirm for your own file.
Can I add a header the list does not know?
Yes: add a header-name rule such as x-tenant-id. Wildcards with * work. Three of your own rules are free; more, and saved policies, are in Pro.
The free plan covers everything on this page. HAR Desk Pro ($29, paid once) is described on the HAR Desk page.
