What Is a HAR File and How to Open One (No Upload)

A support agent replies: "Could you send us a HAR file?" You've never heard of one, the file you end up with is 40 MB of JSON, and you have no idea what's inside it. That last part matters, because a HAR file can contain the same session cookie that keeps you logged in.

This guide explains what a HAR file records, how to export one from Chrome, Firefox and Safari, how to read it, and which parts to remove before you share it. To look inside one right now, drop it into the HAR File Viewer. It runs entirely in your browser, so the file is never uploaded.

What Is a HAR File?

HAR stands for HTTP Archive. It's a JSON file that logs every request a page made while the browser's Network panel was recording. The format has been around since about 2012 and every major browser can export it.

The top level is a log object with a list of entries. Each entry describes one request:

• request: method, URL, headers, cookies, query string and any POST body.
• response: status code, headers, cookies, and the content (MIME type, size and often the body itself).
• timings: how long each phase took, from DNS lookup to the last byte.
• startedDateTime: when the request started, which lets tools draw a waterfall.

That's why support teams like HAR files. They show the exact request that failed, what the server sent back and how long it took, without anyone needing access to your screen.

How to Export a HAR File

In every browser the process is the same: open the developer tools, record, reproduce the problem, then save.

Chrome and Edge

1. Open DevTools with F12, or Cmd+Option+I on a Mac.
2. Go to the Network tab and tick Preserve log so a redirect or reload doesn't wipe the list.
3. Clear the log, then reproduce the problem.
4. Click the download arrow in the Network toolbar and choose the export option. Recent versions of Chrome offer a sanitized export that leaves out cookies and Authorization headers. Check which one you picked, because support sometimes needs the full version.

Firefox

1. Open the developer tools with F12 and go to the Network tab.
2. Tick Persist Logs in the settings menu (the gear icon).
3. Reproduce the problem.
4. Right-click any request and choose Save All As HAR.

Safari

1. Turn on the developer menu: Settings → Advanced → Show features for web developers.
2. Open the Web Inspector with Cmd+Option+I and go to the Network tab.
3. Reproduce the problem.
4. Click Export in the Network toolbar to save the HAR.

How to Open a HAR File

You have three options, depending on what you need:

• A browser-based viewer. The NavioHQ HAR File Viewer shows a request waterfall, a summary by host and type, a list of failed requests, and a scan for cookies and tokens. Parsing happens in your browser tab.
• Chrome DevTools. Drag the .har file onto the Network panel to load it as if you had recorded it yourself. Handy if you already know DevTools well.
• A text editor. It's JSON, so any editor opens it. Large files are slow to scroll, though, and you'll be reading raw timestamps.

Be careful with online HAR analyzers that upload the file to a server. You'd be sending your cookies and tokens to a third party, which is exactly what you want to avoid.

How to Read the Timings

Each entry's timings object splits the request into phases, all in milliseconds. A value of -1 means the phase didn't apply, for example because the connection was reused.

• blocked: time waiting in the browser's queue. High values usually mean too many requests to one host at once.
• dns: looking up the domain name.
• connect and ssl: opening the TCP connection and doing the TLS handshake.
• send: uploading the request.
• wait: waiting for the first byte from the server. If this one is large, the server is slow, not your network.
• receive: downloading the response.

Long query strings are hard to read in a waterfall. Paste one into the Query String Editor to split it into one parameter per row.

What's Sensitive in a HAR File

A full HAR file records what your browser sent, and your browser sends the credentials that prove who you are. In 2023, attackers who got into a support system used session tokens found in customer HAR files to access those customers' accounts. Check for these before you share:

• Cookies in the Cookie and Set-Cookie headers, especially session IDs.
• Authorization headers, often a Bearer token. If it's a JWT, you can see what it grants with the JSON Web Token Decoder, which also runs locally.
• Tokens in URLs, such as access_token, code or sig in OAuth redirects and signed links.
• POST bodies, which can include passwords if you logged in while recording.
• Response bodies, which can include your name, email, address or anything else the page displayed.

How to Redact a HAR File Before Sharing

Open the file in the HAR File Viewer and switch to the sensitive scan. It lists every cookie, auth header and token-like parameter by name and host without displaying the values. The redact mode then saves a copy with those values replaced and response bodies removed, ready to attach to a ticket.

A few more habits help:

• Record in a private window, logged in only to the site you're debugging.
• Log out after recording, which invalidates many session cookies even if one slips through.
• Send the file through the support portal, not a public forum or a shared chat.

This post starts a Saturday series on file formats you can open without installing anything. The rest of this week's posts are collected in our roundup of the best free AI dating tools.

Frequently Asked Questions

Before your next support ticket, export the HAR, open it in the HAR File Viewer, and save a redacted copy. It takes a minute, and you won't be sending anyone your session cookie.