Short answer
Capture the smallest useful window, inspect the HAR locally, remove unrelated requests and copy a redacted request or excerpt whenever the full archive is unnecessary.
Key points
- A HAR may contain sensitive data even when it was created only for performance debugging.
- Browser export options reduce some fields, but they do not replace a review.
- Most support questions need one request or a short sequence, not the whole session.
- Blobster’s sanitized copies mask values by name. Email addresses, IDs and hostnames stay visible.
What a HAR can contain
The HTTP Archive format records network activity. Depending on the browser, export option and application, it can include request and response headers, cookies, query parameters, post data, response bodies, internal URLs and timing information.
Chrome DevTools distinguishes a sanitised export from an export that includes sensitive data. That is useful, but “sanitised” is not the same as “safe for every recipient”. Application identifiers, URL paths and response bodies may still reveal more than the support case requires.
Capture less before redacting more
Start a fresh capture immediately before reproducing the problem and stop it as soon as the relevant request completes. A smaller archive is easier to understand and creates less accidental exposure.
If the issue can be demonstrated with one failed request and its preceding authentication or redirect step, share that sequence instead of several minutes of unrelated browsing.
- Close unrelated tabs and clear the network log.
- Reproduce one scenario with test data where possible.
- Stop recording immediately after the failure.
- Inspect domains, request paths, headers, cookies and bodies.
- Remove requests that do not contribute to the explanation.
Review the evidence locally
A request-list view makes the archive easier to scan than raw JSON. Filter by method, domain, status or a recognisable path, then inspect the selected entry in detail.
Look for authorization values, session cookies, signed URLs, personal data, request payloads, response bodies and internal infrastructure names. Query parameters deserve the same attention as headers.
Prefer an excerpt when it answers the question
A support engineer may need the method, URL shape, status, timing and a few response fields. They often do not need the full cookie jar or every response body in the session.
Copy the request that shows the problem rather than the whole archive. In Blobster, select the entry and use Copy sanitized request or Copy cURL, then review the output before you send it.
What Blobster’s sanitized copies mask
Blobster opens a HAR as a request list with method and status filters, a timing waterfall and the request and response bodies. Copy sanitized HAR copies the whole archive, Copy sanitized request copies the selected entry and Copy cURL turns the selected request into a command, all with the same masking. Copy redacted response masks a response body on its own.
Values are masked by name. A header, cookie, query parameter or body field whose name looks secret, such as Authorization, Cookie, Set-Cookie, api_key, password or anything containing token or session, becomes [REDACTED]. Every value in a cookie list is masked, and Bearer and Basic credentials inside request and response text are masked too.
Everything else stays, including email addresses, customer IDs, internal hostnames and parameters with neutral names. In this sample the email header, the email in the body and the sig parameter survive.
curl -X 'POST' \
'https://api.example.test/v1/orders?api_key=%5BREDACTED%5D&page=2&sig=abc' \
-H 'Authorization: [REDACTED]' \
-H 'Cookie: [REDACTED]' \
-H 'X-Request-Id: req-81' \
-H 'X-Customer-Email: ada@example.test' \
--data-raw '{"email":"ada@example.test","password":"[REDACTED]","note":"call Bearer [REDACTED]"}'