How to open a HAR file (safely, offline)

What is inside a HAR file

HAR (HTTP Archive) is a JSON file that records what a browser sent and received while it was being recorded. Each request is an entry with:

• the full URL, including the query string — which sometimes carries tokens or one-time codes;
• request headers, including Cookie and Authorization unless they were stripped on export;
• response headers, including Set-Cookie;
• the request body — form posts and API payloads, which can include what you typed into a login form;
• often the response body — the HTML, JSON or other content the server returned, which can include your personal data;
• timings for each phase of the request.

That is exactly why support teams ask for HAR files — and why they are risky. A live session cookie in a HAR can let whoever holds the file act as you on that site until the session ends. In October 2023, Okta disclosed that an attacker had accessed HAR files customers had uploaded to its support system and used session tokens found in them.

1. Chrome or Edge DevTools

1. Open any tab and press F12 (or Ctrl+Shift+I; Cmd+Option+I on a Mac).
2. Go to the Network panel.
3. Drag the .har file onto the list of requests, or click Import HAR in the toolbar at the top of the panel.
4. Click any request to see its headers, payload, response and timing.

This costs nothing and nothing is uploaded. The downsides: the panel is built for live debugging, so the imported requests share space with the tab's own traffic, and very large files can make DevTools slow. Edge's DevTools are built on the same Chromium code, so the steps are the same, though labels can differ slightly between versions.

2. Firefox

1. Press F12 and open the Network tab (the Network Monitor).
2. Open the menu of other actions at the top of the Network Monitor and choose Import HAR.
3. Pick the file; the requests appear in the list, ready to inspect.

3. A text editor

Because a HAR is JSON, Notepad, TextEdit, VS Code or any code editor will open it. That is the fastest way to search for a specific string — for example to check whether a token or your email address is in the file — but reading a waterfall of hundreds of requests as raw JSON is slow going. An editor that can format JSON makes it bearable.

4. Online HAR viewers — the catch

Search for “HAR viewer” and most results are websites: drop the file in and they draw a nice table. Some say they process the file in your browser; others send it to a server. Either way you are trusting that page's code with everything listed in what is inside a HAR — cookies, tokens, form data. If the file came from a logged-in session, treat an online viewer as sharing the file with the site's operator. For a file recorded on a public page with no login, the risk is small.

5. An offline viewer: HARScope

HARScope is our free Chrome extension for reading HAR files on your own computer. It has no permissions and makes no network requests, so the file has nowhere to go.

1. Click the HARScope icon in Chrome to open the viewer.
2. Drag your .har file onto it, or click Open HAR file….
3. Use the request table and the waterfall to find what you need; click a request for its details.

What it shows: a request waterfall; a searchable request table with status, method, type, size and time; a detail panel with request and response headers, query string, payload, response body and timings; filters by URL, type, method and status. The table is virtualized, so files with thousands of requests stay quick. It is free, with no account, ads or tracking, in English, Spanish and Russian.

How to create a HAR file

In Chrome (and Edge)

1. Open the page where the problem happens, press F12 and go to Network.
2. Tick Preserve log so requests are kept across page loads. Ticking Disable cache often helps too, so the browser fetches everything fresh.
3. Reload the page and reproduce the problem.
4. Click Export HAR (sanitized)… in the Network toolbar and save the file.

Chrome's default export is the sanitized one: it leaves out the Cookie, Set-Cookie and Authorization headers. A full export with those headers exists, but only after you enable Allow to generate HAR with sensitive data in DevTools Settings → Preferences → Network. Send that version only if the person asking really needs it.

In Firefox

1. Open the Network Monitor (F12 → Network) and turn on Persist Logs in its settings menu if the problem involves a page change.
2. Reproduce the problem.
3. Choose Save All As HAR from the Network Monitor's menu, or right-click the request list.

How to clean a HAR before sharing

Chrome's sanitized export is a good start, but it only removes three headers. Things it leaves in place:

• tokens and codes in URLs and query strings (look for token=, code=, key=, session);
• request bodies — login forms, API payloads, anything you typed;
• other headers that carry credentials, such as custom X-API-Key or CSRF headers;
• response bodies with your personal data.

A practical routine:

1. Record as little as possible. Start recording just before the problem, stop right after, and use a test account if you can.
2. Export sanitized in Chrome, or remove cookies in Firefox's output by hand.
3. Look inside. Open the file in a viewer that stays on your computer — DevTools or HARScope — and check the requests that matter: their headers, query strings and payloads.
4. Edit what should not leave. In a text editor, search for cookie, authorization, token, password, session, key and your email address, and replace the values (not the names) with something like REDACTED. Keep the quotes and commas intact so the file stays valid JSON — reopen it afterwards to make sure it still loads.
5. Share through the support team's own channel, not a public link, and ask them to delete it when the case is closed.
6. End the session. Signing out of the site after recording usually invalidates the session cookies the file contains, in case any slipped through.