How to open a HAR file: free HAR viewers and HAR analyzers

A HAR file is JSON with a .har extension, so several kinds of tools can read it. Pick based on what you need to find:

• Chrome or Edge DevTools: the best HAR file viewer for most people. You get the full Network panel, filters, the timing waterfall and response previews, and the file never leaves your machine.
• Google HAR Analyzer: a free HAR viewer online from the Google Admin Toolbox. Useful when you are not on Chrome or want to group requests by page and redact a file.
• A text editor or JSON viewer: VS Code or any editor can open the file. Good for searching for one value, poor for reading hundreds of requests.
• jq on the command line: the fastest way to answer a specific question about a large file, such as which requests failed.

If you do not have a file yet, see how to create a HAR file in Chrome, or read what a HAR file is first.

After you import the file, the Network panel behaves almost the same as during a live recording. The Network features reference documents every option. These are the ones that help most with an unfamiliar file:

• Type buttons (All, Fetch/XHR, JS, CSS, Img and others) to hide static assets and focus on API calls.
• Property filters in the Filter box: status-code:404, method:POST, domain:api.example.com, larger-than:100k, mime-type:application/json. Several properties together act as AND, and OR is not supported.
• The Invert checkbox next to the Filter box to hide everything that matches, for example to drop a noisy analytics domain.
• Sort by the Status, Time or Size column to group errors and find the slowest and heaviest requests.
• Right-click a request and choose Copy > Copy as cURL to replay it in a terminal.

Opening the file shows you the data. Analyzing it means finding the few requests that explain the problem. With the HAR imported into the Network panel, work through it in this order:

1. Find failed requests. Click the Status column header to sort, or filter one code at a time with status-code:500 or status-code:401. Chrome's status-code: filter matches exact codes only.
2. Go back to the default order, which follows start time, and find the first failure. Later errors are often a side effect of the first one.
3. Find slow requests. Click the Time column to sort by duration, then look at the Waterfall column. Long bars stand out, and gaps show where the page sat waiting.
4. Hover a bar in the Waterfall, or open a request's Timing tab, to see where the time went: Queueing, Stalled, DNS Lookup, Initial connection, Request sent, Waiting (TTFB) and Content Download.
5. Open the Response tab of each failing API call. The body usually holds the real error message.
6. Press Ctrl+F (Cmd+F on a Mac) to search headers, payloads and responses for an error code, an order ID or a user email.

In the Timing tab, a long Waiting (TTFB) means the server was slow to respond. Long Queueing or Stalled points to the browser holding the request back, often because too many requests to one host were open at once. Long DNS Lookup or Initial connection points to the network.

Go to toolbox.googleapps.com/apps/har_analyzer and select your HAR file. The analysis screen lists every request and lets you group entries by page, change how timings are shown, filter by status code class and search with free text.

Its most useful extra is redaction. After loading a file, use the redaction button in the top left to download a copy with sensitive values removed, which you can then share. For anything beyond a quick look, Chrome DevTools gives you a fuller waterfall and response previews.

For large files or repeated checks, jq is quicker than any HAR viewer. Requests live in log.entries, each with a request, response and timings object. Some useful queries:

# How many requests are in the file
jq '.log.entries | length' session.har

# Method, status and URL for every request
jq -r '.log.entries[] | "\(.request.method) \(.response.status) \(.request.url)"' session.har

# Only failed requests (status 0 means the request never got a response)
jq -r '.log.entries[] | select(.response.status >= 400 or .response.status == 0) | "\(.response.status) \(.request.url)"' session.har

# The 10 slowest requests
jq -r '.log.entries | sort_by(-.time) | .[:10][] | "\(.time | round)ms \(.request.url)"' session.har

# Distinct URLs without query strings, most called first
jq -r '.log.entries[].request.url | sub("\\?.*"; "")' session.har | sort | uniq -c | sort -rn

Response bodies are in response.content.text. When response.content.encoding is base64, decode the text before reading it.

Whichever HAR analyzer you use, these patterns explain most problems:

• Status 4xx, 5xx or 0. A 401 or 403 points to auth, a 5xx to the server, and 0 to a blocked, cancelled or CORS-rejected request.
• In the HAR timings, a large wait value means the server was slow, while large blocked, dns or connect values point to the network or connection limits.
• Redirect chains: several 301 or 302 responses in a row, often around login.
• Large responses: payloads of several megabytes that slow down rendering.
• The same API call repeated many times in a row, which often means a retry loop or a component rendering more often than it should.

If the file is missing the requests you expected, it was probably recorded without Preserve log, so a navigation cleared them. See how to preserve the network log in Chrome before you record again.

Only if you trust the site and the file has been sanitized. A HAR file can contain session cookies, bearer tokens, API keys and personal data from responses. Opening it in Chrome DevTools or with jq keeps it on your machine, so prefer those for files exported with sensitive data. If you must share a file, redact it first and log out of the recorded session afterwards to invalidate its cookies.

Netraptor cannot open or import an existing HAR file. Use Chrome DevTools or one of the tools above for that. It helps when you can reproduce the issue yourself, because you can analyze the live traffic directly and skip the export and import round trip.

• Open the Netraptor panel in DevTools and it captures the tab's requests as they happen, with Chrome-style type chips, a Waterfall column and a Timing tab for each request.
• Filter with the same syntax as Chrome, plus wildcards and OR: status-code:4xx OR status-code:5xx shows every failure at once.
• Press Cmd/Ctrl+F to search request and response headers and bodies, with case-sensitive and regex options.
• Identical requests that arrive back to back collapse into one row marked ×3, so retry loops are easy to spot. Hide noise keeps analytics and ad calls out of the way.
• Right-click any row and choose Save all as HAR (sanitized) to hand the session to someone else. Credentials are stripped from headers, URLs and JSON bodies.

To keep a site's API calls after you close DevTools, turn on Keep history for this site in the Netraptor popup. Capture, filters, search and HAR export are all on the Free plan, and the data stays in your browser.