HAR Viewer & Sanitizer

A browser-only HAR viewer that redacts sensitive data before you share network logs

HAR files are the standard way to capture browser network activity. They are also a plain-text record of every credential your browser sent during the recording session. Session cookies, API keys, Bearer tokens, passwords in POST bodies, OAuth codes in query parameters. All of it sits in the HAR, unencrypted, ready to be extracted.

Sharing unsanitized HAR files with support teams, QA, or in public bug reports is how credentials leak. The 2023 Okta breach started with HAR files stolen from support sessions. The attacker extracted cookies from those files and replayed them to access customer tenants.

DevBento’s HAR Viewer runs entirely in your browser. No uploads, no server processing. Load a file, inspect the requests, click one button to strip sensitive headers and tokens, and download the clean version for sharing.

Why sanitize HAR files?

HAR captures are complete by design. Every request header, every cookie, every response body. Browser DevTools have no built-in redaction filter. Chrome and Firefox export everything visible in the Network tab.

The fields that carry credentials:

Cookie and Set-Cookie headers carry session tokens, authentication cookies, and CSRF tokens. A session cookie grants immediate access to an account.

Authorization headers carry Bearer tokens, Basic auth credentials (base64-encoded user:password), and API keys. Basic auth is encoded, not encrypted.

Request bodies in POST and PUT calls often contain passwords, tokens, payment data, and PII. JSON bodies in API calls include credentials the server expects but the HAR exposes.

Query parameters contain OAuth authorization codes, state tokens, session identifiers, and redirect URIs. These can be replayed to complete authentication flows.

Response bodies return access tokens, refresh tokens, and user data from API endpoints.

Sanitizing a HAR file means replacing these values with a placeholder before sharing. The timing data, status codes, URLs (without sensitive params), and payload structure stay intact for debugging.

Features

Waterfall Visualization. Every request renders as a horizontal bar segmented by timing phase, exactly like Chrome DevTools. Colors map to specific phases: blocked (gray), DNS (blue), connect (cyan), SSL (teal), send (green), wait (amber), receive (bright green). Hover any segment to see the exact duration in milliseconds.

Smart Filters. Narrow down requests using category tabs (HTML, CSS, Scripts, Fetch/XHR, Images, Fonts, Media, Other), duration and size dropdowns, or quick toggles for Errors Only and Large Payloads. The search box filters by URL, method, or status code.

One-Click Sanitize. Strips authorization headers, cookies, set-cookie headers, API keys, passwords, and tokens. The rest of the HAR data (timing, status codes, URLs, payload structure) stays intact for debugging.

Export Clean HAR. Download the sanitized file as a valid HAR JSON ready for sharing with QA, support, or engineering teams.

Performance Audits. Scans your HAR file for slow TTFB responses (>800ms), uncompressed text assets, large payloads (>2MB), and duplicate URLs. Each audit links to the affected requests so you can jump straight to them.

Client-Side Only. Your network logs stay on your machine. No upload, no server processing, no tracking.

Understanding the waterfall timeline

The waterfall timeline is the most useful part of any HAR viewer. Each row represents one HTTP request, and the horizontal bar shows how that request spent its time. Reading it correctly helps you find real performance bottlenecks instead of guessing.

The timeline breaks every request into sequential phases. Blocked time is the period the browser spent waiting before it could start the request. A high blocked time often means too many connections are competing for the same origin. DNS lookup measures how long it took to resolve the hostname. Slow DNS usually points to your DNS provider rather than your application. Connect time covers the TCP handshake. If you see high connect times alongside high SSL/TLS negotiation times, the server may be far from the user or the TLS configuration needs tuning. Send time is how long the browser took to transmit the request body. For most API calls this is negligible unless you are uploading large payloads. Wait time (TTFB, or Time to First Byte) is usually the most important metric. It measures how long the server took to start responding after receiving the request. A TTFB over 200ms on a CDN cached resource or over 800ms on a dynamic endpoint warrants investigation. Receive time is how long the browser spent downloading the response body. Large values here mean large payloads or slow network throughput.

Stacked bars are not cumulative. Each segment starts where the previous one ended. The total bar width adds up to the total response time. If a bar looks visually short next to another bar, that request finished relatively fast. The time ruler at the top of the waterfall shows the absolute time scale so you can compare requests across the page load.

The most common performance patterns to look for: a long blocked phase means connection pooling is saturated, a long wait phase means the server or database is slow, a long receive phase on a small resource means the network itself is congested, and a request that starts very late in the waterfall (far from the left edge) was queued behind something else.

Use cases

Share debug logs with support teams without exposing session tokens or API keys. Export network traces for bug reports while keeping sensitive headers redacted. Inspect large HAR files locally instead of uploading to a third party service that may log your data. Find slow API endpoints by sorting by duration or scanning the waterfall for long wait bars. Check whether static assets are properly compressed by looking for compression audit warnings.

How it works

1. Drag and drop a HAR file onto the page or click Open HAR File to browse. Or click Try Demo to load sample network data.
2. Browse all requests in the waterfall table. Click any row to expand its full details: summary, headers, body, and timing breakdown.
3. Use the search box, category tabs, duration and size dropdowns, or quick filters (Errors Only / Large Payloads) to narrow down the list.
4. Click Sanitize HAR to redact sensitive headers and cookies.
5. Download the clean HAR file for secure sharing.

Supported HAR files

Chrome DevTools HAR exports. Firefox Network Log exports. Safari Network tab exports. Any valid HAR JSON file.