What is a HAR file?

What HAR stands for

HAR stands for HTTP Archive. It is a file format for saving a browser's network traffic so it can be examined later, or on someone else's computer. The format is plain JSON and must be saved as UTF-8 text, which is why any text editor can open a HAR file.

The format was written up as a draft for the W3C Web Performance Working Group, but that draft was never published as a standard and is now marked as abandoned. The structure below follows that draft's version 1.2 of the format.

What a HAR file looks like inside

Every HAR file has a single top-level object called log. Inside it, version, creator (the tool that wrote the file) and entries are required; browser, pages and comment are optional. The interesting part is entries: one object per request. Here is a trimmed example — the comments are ours, a real file has none:

{
  "log": {
    "version": "1.2",                       // version of the HAR format
    "creator": { "name": "…", "version": "…" },  // the tool that wrote the file
    "pages": [ … ],                         // optional: pages loaded while recording
    "entries": [                            // one object per request
      {
        "startedDateTime": "2026-10-17T09:30:12.345Z",
        "time": 182,                        // total time, milliseconds
        "request": {
          "method": "POST",
          "url": "https://example.com/api/login?next=%2Faccount",
          "headers": [ { "name": "Cookie", "value": "session=…" } ],
          "cookies": [ … ],
          "queryString": [ { "name": "next", "value": "/account" } ],
          "postData": { "mimeType": "application/json", "text": "{\"email\":…}" }
        },
        "response": {
          "status": 200,
          "headers": [ { "name": "Set-Cookie", "value": "…" } ],
          "content": { "size": 5120, "mimeType": "application/json", "text": "…" }
        },
        "cache": {},
        "timings": { "blocked": 2, "dns": -1, "connect": -1,
                     "send": 0, "wait": 160, "receive": 20 }  // -1 = did not apply
      }
    ]
  }
}

Read it top to bottom and you can reconstruct the whole conversation between the browser and the server:

• request — the method, the full URL, the request headers, the cookies sent, the query-string parameters and, for form posts and API calls, the body in postData.
• response — the status code and text, the response headers (including Set-Cookie), any redirect target, and a content object with the size, the MIME type and, when the browser saved it, the body itself in text. Binary content such as images can be stored base64-encoded.
• timings — how long the request spent in each phase, in milliseconds: blocked, dns, connect, ssl, send, wait (waiting for the server's response) and receive. A value of -1 means that phase did not apply, for example when no DNS lookup was needed.

What HAR files are used for

Support tickets. “It doesn't load” is hard to act on; a HAR file shows which request failed, the status code, the error message the server sent back and the headers involved. That is why software vendors often ask customers to record one and attach it to a case.

Debugging. Developers use HAR files to compare a working and a broken session, to see what a page really sent to an API, or to hand a reproducible trace to a colleague who cannot reproduce the bug.

Performance. The per-request timings show where a slow page spends its time: waiting for the server, downloading large files, or queuing requests one after another.

Because Chrome, Edge and Firefox can import a HAR file back into their developer tools, the person who receives it sees the same request list you saw.

What private data a HAR file can contain

A HAR file is a full record of a logged-in session unless something removed parts of it. Expect to find:

• Cookies — in the Cookie request header, the Set-Cookie response header and the separate cookies lists. Session cookies are what keep you signed in.
• Authorization headers — bearer tokens and other credentials that APIs accept instead of a cookie.
• Tokens in URLs — one-time codes, API keys, password-reset and sign-in links often travel in the query string, which is stored in full.
• Form fields — whatever you typed and submitted while recording, including email addresses, addresses and passwords, sits in postData.
• Response bodies — account pages and API responses with your name, email, orders or messages.
• Other headers — custom headers such as API keys or CSRF tokens.

This is not a theoretical risk. In 2023, Okta reported that an attacker had accessed files in its customer support system, some of them HAR files with session tokens that could be used to hijack the customers' sessions. A valid session token works like a temporary password: whoever has it can act as you on that site until the session ends.

How big a HAR file gets

There is no fixed size. A HAR file grows with every request recorded, and most of the weight comes from response bodies: when the browser stores them, a page's scripts, stylesheets and API data end up in the file as text, and binary files such as images can be stored base64-encoded, which takes four characters for every three bytes — about a third more than the original. Recording a short, focused session on a light page gives a small file; leaving the recorder running while you browse a media-heavy site gives a large one. Large files open slowly in some tools, which is one more reason to record only what you need.

How to open and read one

You do not need special software. The developer tools in Chrome, Edge and Firefox import HAR files, and any text editor shows the raw JSON. Our guide how to open a HAR file safely walks through each option, including why uploading a HAR to an online viewer is risky.

A HAR viewer that runs offline, like HARScope, lets you check what is inside before you send it. HARScope is our free extension for Google Chrome™: it has no permissions and makes no network requests, so the file stays on your computer while you look through its requests, headers, bodies and timings.

How to create one

Every major desktop browser can record a HAR file from its developer tools: open the Network panel, reproduce the problem, then export. The details differ — Chrome and Edge call the option Export HAR, Firefox calls it Save All as HAR, Safari simply Export. Our step-by-step guide covers all four: how to create a HAR file in Chrome, Edge, Firefox and Safari.

Is it safe to send a HAR file?

It is safe once you know what is in it. Browsers have started to help, but none of them makes the decision for you.

Chrome and Edge. Since Chrome 130, the standard Export HAR (sanitized) leaves out sensitive data such as the Cookie, Set-Cookie and Authorization headers. Edge documents the same default. A version with that data exists, but only after you turn on Allow to generate HAR with sensitive data in DevTools settings. Chrome's documentation does not say that the sanitized export touches URLs, request bodies, response bodies or other headers, so treat those as still present.

Firefox and Safari. Their documentation describes a single HAR export of everything in the network log, with no sanitized variant, so assume the file contains cookies and tokens.

Before you send any HAR file:

1. Record as little as possible — start just before the problem, stop right after, and use a test account if you can.
2. Look inside in a tool that stays on your computer: DevTools, a text editor or an offline viewer.
3. Search and replace the values of anything that should not leave — cookies, authorization, token, password, key, your email address — with a placeholder such as REDACTED, keeping the quotes and commas so the file is still valid JSON.
4. Send it through the vendor's support channel, not a public link, and ask for it to be deleted when the case is closed.
5. Sign out of the site afterwards, so the session recorded in the file is less likely to stay usable.

Microsoft Edge is a trademark of Microsoft Corporation; Firefox is a trademark of the Mozilla Foundation; Safari is a trademark of Apple Inc.