Not by default. A HAR file is a JSON record of network requests and can carry cookies and authorization headers. Chrome DevTools exports a sanitized version that excludes Cookie, Set-Cookie and Authorization headers, but you should still review the file before sending it, because other fields can hold tokens.
What a HAR file is
Chrome's DevTools documentation describes HAR, short for HTTP Archive, as a file format used by several HTTP session tools to export captured data. The format is a JSON object with a particular set of fields. Support teams ask for HAR files because they show exactly what a browser sent and received, including timings and errors.
That detail is also the risk. A capture of a signed in session can contain the headers and bodies that prove who you are.
What the sanitized export does
The documentation says that to reduce the chance of accidental leaks of sensitive information, you can by default export the sanitized network log, which excludes sensitive information such as Cookie, Set-Cookie and Authorization headers. If required, you can also export with sensitive data.
You have two ways to save: right click a request in the Network panel and choose the option to save all listed requests as HAR (sanitized), or use the download button labelled Export HAR (sanitized) at the top of the Network panel. The menu also offers a version with sensitive data, so read the label before you click.
What may still be inside
The documentation names three header types as examples. Secrets travel in other places too, and you cannot assume the sanitized file is clean:
| Where | Example risk |
|---|---|
| URL query strings | Tokens or signed links in the address |
| Request bodies | Passwords or one-time codes in a form post |
| Response bodies | Session data, personal details, API keys returned by an endpoint |
| Custom headers | An API key header with a vendor specific name |
The file is JSON, so you can open it in an editor and search for words such as token, key, session and password before sharing.
A safe sharing routine
- Capture in a fresh session where possible, using a test account.
- Export the sanitized version.
- Search the file for tokens, query strings and personal data, and redact what you find.
- Send it over the channel your support team names, not a public ticket or forum.
- After the case is closed, ask the recipient to delete it, and log out of the session you captured.
- If you ever shared an unsanitized file, sign out everywhere, rotate any API keys it contained and change the password if one appeared.
Advice for teams that request HAR files
State in your support instructions that the sanitized export is expected, and offer a private upload link. Warn customers that bodies and URLs may still contain sensitive values. Store received files with restricted access and a deletion date, since a pile of HAR files from many customers is a tempting target.
Where Safeguard fits
Safeguard works on the dependency and code side of your software: SBOM and dependency scanning, reachability analysis and policy gates. It does not store or manage credentials, so keep using your password manager, secrets manager or cloud identity for that. You can run a free scan of a project at gold.safeguard.sh/scan.
Quick check
Does the sanitized export remove everything sensitive?
No. The documentation lists cookie and authorization headers as examples of what it excludes. Review the rest yourself.
Where is the export button?
In the Network panel, either the Export HAR (sanitized) button in the action bar or the right click menu, per the documentation.
What if I shared the full file by mistake?
Treat the session and any keys inside as exposed. Sign out, rotate and change passwords as needed.
Sources
Last reviewed: 19 October 2026.
