Mightora · HAR troubleshooting guide
HAR file security: what not to share
Learn what sensitive information HAR files can contain, how to minimise exposure and why local analysis is safer than uploading confidential captures.
A HAR (HTTP Archive) captures browser network activity for troubleshooting. This can make it useful for debugging but dangerous to circulate without review. HAR files can include information that would not normally appear on a public support ticket.
What sensitive data can a HAR contain?
- Authentication material: bearer tokens, session identifiers, cookies and API keys.
- Personal information: form submissions, email addresses, profile data and customer identifiers.
- Private URLs: internal hostnames, signed download links and query parameters.
- Application payloads: request bodies and response contents returned by APIs.
- Environment details: service domains, error messages and integration endpoints.
Before capturing a HAR
Use a test account and non-production data when practical. Limit the capture to the failing action and avoid unrelated tabs or workflows. Where the browser supports it, choose an export mode that excludes sensitive information. Treat sanitisation by browser tools as best-effort rather than a guarantee.
Before sharing a HAR
Assume the original file contains confidential information until you have inspected it. Remove or replace credentials, cookies, secrets, personal data and sensitive payloads. Consider sharing a minimal written reproduction or a sanitised diagnostic report instead of the original HAR.
How Mightora reduces exposure
The online analyser processes captures in your browser rather than an upload service. The offline HTML edition goes further by embedding its assets, so it needs no network connection. No captured URLs are fetched or replayed. This reduces transmission risk but does not remove risks associated with storing or sharing the original file.
Limitations of sanitised exports
Mightora excludes raw headers, cookie values, bodies, URL query strings and fragments from its generated summary. Hostnames and some URL path segments remain, and broad contextual information can still be identifying. Review every export before you send it elsewhere.
For troubleshooting steps, read how to inspect HAR errors and timings.
Try it yourself: Open the free private HAR analyser or download the offline ZIP.
