In the app
Choose export type
Export
Safe Export
Cancel
Both are offered in Live with Export, and in History with Share.
The session as recorded, in plain JSON.
Opened by anyone
"url": "https://api.lumen.example/v1/accounts""Authorization": "Bearer eyJhbGciOiJIUzI1NiJ9…""Cookie": "session=8f3c2a…""bodyBase64": "eyJpdGVtcyI6W3siaWQi…"Every request can be read: URLs, headers with their tokens and cookies, bodies in base64, decoded in one step.
Opens in the app, in Session Studio and in any text editor.
The same session, encrypted with a password you choose.
Opened without the password
"isEncrypted": true"salt": "kR2v9qW1xT0bQe7uLm4c8A==""encryptedData": "Vb9xN3qT0pKcW8fJr2Ls…"No URL, no header, no body: only what the right password needs to decrypt it.
Opens in the app and in Session Studio, once the password is entered.
Safe Export, step by step
Spaces at the start and end are ignored. An empty password is refused.
Safe Export
Enter a password to encrypt the exported file.
Export
The password and a random salt give a 256-bit key. The salt is new on every export.
AES-256-GCM encrypts and seals the whole session: if a single byte of the file changes, it no longer opens.
It holds the salt and the encrypted data, never the password. It is written to a temporary folder, then handed to the share sheet.
Exporting from Live? The readable session is saved to History first. The encrypted copy is only for sharing: it never appears in History. How Session History works
Receiving a Safe Export
Import the file in History with Import trace. The copy kept on the phone stays encrypted.
In History
The app asks for the password before showing the screens and requests.
UnlockReplay asks for it too, before serving the responses.
ReplayDecrypted in your browser: neither the file nor the password is uploaded.
In this browserWrong password, or a file modified on the way: the session does not open, and the app says why.
Unable to decrypt trace. Password may be incorrect or file may be corrupted.