What is a HAR file? Meaning, contents and how to get one

HAR stands for HTTP Archive. A HAR file is plain JSON with a .har extension that describes a browser's network activity: one entry per request, grouped under the pages that triggered them. Chrome, Edge, Firefox and Safari can all export it, and most debugging tools can read it.

The format was drafted as HAR 1.2 for the W3C Web Performance Working Group. That draft was never published as a standard and is now marked as abandoned, but browsers still write files that follow it. A trimmed HAR file looks like this:

{
  "log": {
    "version": "1.2",
    "creator": { "name": "WebInspector", "version": "537.36" },
    "pages": [{ "id": "page_1", "title": "https://app.example.com/" }],
    "entries": [
      {
        "pageref": "page_1",
        "startedDateTime": "2026-10-16T09:12:03.120Z",
        "time": 184.2,
        "request": { "method": "GET", "url": "https://app.example.com/api/orders" },
        "response": { "status": 500, "statusText": "Internal Server Error" },
        "timings": { "blocked": 1.1, "dns": 0, "connect": 0, "send": 0.2, "wait": 176.4, "receive": 6.5 }
      }
    ]
  }
}

Each entry in log.entries captures one request and its response. The fields you will look at most:

• request: method, full URL, query string, headers, cookies and the request body (postData).
• response: status code, headers, cookies, MIME type and usually the response body in content.text.
• timings: how long the request spent blocked, on DNS, connecting, sending, waiting for the server (wait) and downloading (receive), in milliseconds.
• startedDateTime and time: when the request began and how long it took in total.
• pages: the page loads the requests belong to, so you can tell which navigation triggered what.

Because it holds full headers, bodies and timings, a HAR file lets someone else see your browser's traffic without access to your account or machine. The common uses:

• Support tickets. A vendor asks for a HAR file to see the failed API call, the error body and the request that caused it.
• Performance work. The timings show which requests were slow and whether the server or the network was to blame.
• Debugging redirects and login loops, where the order of 301, 302 and Set-Cookie responses matters.
• Documenting an API. A HAR file is a list of real calls, which converters can turn into a Postman collection or an OpenAPI spec.

In Chrome, open DevTools on the page, go to the Network panel, check Preserve log, reproduce the problem and click Export HAR (sanitized) in the action bar. DevTools only records while it is open, so open it before you start. How to create a HAR file in Chrome walks through each step and how to remove tokens before you share the file.

• Microsoft Edge uses the same DevTools as Chrome, so the steps are the same.
• Firefox: open the Network Monitor (Ctrl+Shift+E or Cmd+Option+E), reproduce the issue, then right-click any request and choose Save All As HAR.
• Safari: enable the Develop menu in Safari settings, open Web Inspector, go to the Network tab, reproduce the issue and click Export.

If the file comes out empty or misses the first page load, Preserve log was off or DevTools was opened too late. See how to keep network requests after a reload.

Since Chrome 130, the default HAR export is sanitized: it leaves out the Cookie, Set-Cookie and Authorization headers. This change was made to cut down on accidental leaks of login sessions when people attach HAR files to support tickets.

If you need those headers, for example to debug your own auth flow, open DevTools Settings > Preferences > Network and turn on Allow to generate HAR with sensitive data. The Export HAR button then offers both a sanitized and a sensitive-data option. See the Network features reference for the current labels.

Treat a HAR file like a password. A file exported with sensitive data contains session cookies and bearer tokens, and anyone who has it can often act as you until those expire. Even a sanitized file can include personal data from API responses, IDs in URLs and API keys in custom headers.

Before you share one:

• Use the sanitized export unless the recipient specifically needs auth headers.
• Record in a fresh tab with only the steps needed to reproduce the issue, so unrelated traffic stays out of the file.
• Search the file for token, key, password, secret and your email address.
• Log out after sending a file that included cookies. That invalidates the session on most sites.

Google's HAR Analyzer also has a redaction button that downloads a copy with sensitive values removed.

Chrome's Network panel records everything, but only while DevTools is open, and you have to remember Preserve log first. Netraptor is a Chrome extension with its own panel in DevTools that keeps more of the session for you.

• Open the Netraptor panel and it captures the tab's requests right away, grouped under each page load, including single-page-app route changes.
• Right-click any request and choose Save all as HAR (sanitized). It strips credentials from headers, URLs and JSON bodies, which goes further than Chrome's sanitized export.
• Turn on Keep history for this site in the toolbar popup to save the site's fetch and XHR calls with DevTools closed, then export a HAR file from the Export tab later. Strip auth headers and cookies is on by default there.

HAR export is part of the Free plan, along with Postman and curl exports. Everything stays in your browser and no account is needed. History saved with DevTools closed holds API calls only, so if you need images and scripts in the file, export while the panel is open or use Chrome's own export.

Once you have the file, you can load it back into Chrome DevTools, open it in a HAR viewer online or query it with jq. See how to open and analyze a HAR file. If you want to replay the requests you captured, turn them into a Postman collection.