A HAR (HTTP Archive) file is a JSON recording of everything the browser requested while a page was open: each URL, its request and response headers, the timings, the sizes, and often the response bodies. It is the format the Network tab exports, and the thing support teams ask for when they need to see what your browser actually did.

How do I open a HAR file?

It is JSON, so any text editor will open it, but nothing about it is readable that way. Use a viewer that shows one row per request: drag the file onto Chrome DevTools' Network tab, or open it in a browser-based viewer that parses it locally.

Is it safe to send a HAR file?

Not as exported. A HAR usually contains your session cookies, Authorization headers and anything typed into a form, including passwords, so whoever receives it can often sign in as you. Redact those values first and treat the original like a credential.

What does a HAR file contain?

For every request: method, URL, query string, all request and response headers, cookies, any posted form data, the status code, sizes, and a timing breakdown of DNS, connect, TLS, send, wait and receive. If it was exported 'with content', it also contains the response bodies.

How do I read HAR file timings?

Each entry has a timings object in milliseconds. 'blocked' is time queued, 'dns' and 'connect' are connection setup, 'ssl' is inside connect, 'send' is uploading the request, 'wait' is the server thinking (time to first byte), and 'receive' is downloading the response. A large 'wait' points at the server; a large 'blocked' points at too many parallel requests.

What is a HAR file?

A HAR file (HTTP Archive) is a JSON recording of every request your browser made while a page was open — each URL, its headers, how long it took, and often the response itself. Support teams ask for one when they need to see what actually happened on your machine. It is also one of the most sensitive files you can email, and almost nobody says so.

On this page

What is actually inside one
How to export a HAR file
How to open and read one
Reading the timings
Why you should redact it first

What is actually inside one

A HAR is a single JSON object with a log containing an array of entries, one per request, in the order the browser made them. Each entry holds:

request	Method, full URL, the query string broken out, every request header, cookies, and `postData` if anything was sent.
response	Status code, every response header, `Set-Cookie` values, the MIME type, sizes, and the body if the export included content.
timings	How long each phase took, in milliseconds.
startedDateTime	When the request began, which is how a viewer reconstructs the waterfall.
serverIPAddress, connection	Which server answered and which TCP connection was reused.

The format is a W3C draft that never became a standard, which is why exports differ slightly between browsers. Every viewer worth using tolerates that.

How to export a HAR file

Chrome or Edge

Open DevTools with F12 and go to Network.
Tick Preserve log so a redirect or reload does not wipe what you captured.
Reproduce the problem.
Right-click any row → Save all as HAR with content, or Save all as HAR to leave response bodies out (smaller, and much less sensitive).

Firefox

Network tab → the gear icon at the right → Save All As HAR.

Safari

Enable the Develop menu in Settings → Advanced, open the Web Inspector's Network tab, then Export.

How to open and read one

Opening it in a text editor tells you almost nothing: a minute of browsing is megabytes of JSON. Use something that shows one row per request.

Chrome DevTools imports a HAR: open the Network tab and drag the file onto it. You get the same waterfall you would have seen live.
Our HAR viewer reads it in the page, with no upload, and additionally lists which requests carry cookies, tokens or a posted password — and saves a redacted copy.

Whatever you use, read it in this order: filter to the failing request, check its status, then its response headers, then its timings. Most investigations end at the status code and the first header.

Reading the timings

Every entry has a timings object, in milliseconds. -1 means "does not apply".

blocked	Queued in the browser, usually waiting for a free connection. Large numbers mean too many parallel requests to one host.
dns	Name lookup. Only on the first request to a host.
connect / ssl	TCP and TLS setup. `ssl` is counted inside `connect`.
send	Writing the request. Big only when uploading.
wait	Time to first byte — the server thinking. This is the number to quote when you report a slow API.
receive	Downloading the response body.

Why you should redact it first

A HAR captures the headers as they were sent, which means it captures your Cookie header, your Authorization bearer token, any api_key in a URL, and the body of the login form you submitted — password included. Anyone holding that file can usually act as you until those credentials expire. Support inboxes are shared, ticket systems are searchable, and attachments outlive the ticket.

Before you send one: open it, find every request carrying a credential, replace the values, and send the copy. Our HAR viewer does exactly that in your browser — it flags the requests that carry credentials and saves a redacted copy that keeps the URLs, statuses, header names and timings a support engineer actually needs.

Debugging the headers themselves?

HeaderForge sets and removes request and response headers for the sites you choose, unblocks CORS for local testing, and shows which of your rules actually fired — so you can tell a rule that did nothing from a server that ignored it. Free, local only, no account and no analytics.

Get HeaderForge for Chrome

More on this topic: JWT decoder and generator · JWT errors: jwt malformed, invalid signature, jwt expired and more · UUID generator · How to add a custom HTTP header to requests in Chrome