HAR Files: HTTP Archive Format for Web Performance and API Debugging

HAR Files: Capturing and Analyzing HTTP Traffic

HAR (HTTP Archive) is a JSON-based format for recording HTTP request and response data. When you open a browser's Developer Tools, navigate to the Network tab, and export the captured traffic, the result is a .har file. This single file contains a complete record of every HTTP transaction — URLs, headers, cookies, request bodies, response bodies, timings, and status codes — making HAR the universal format for web performance analysis, API debugging, and security auditing.

HAR File Structure

A HAR file is a JSON document with a strict hierarchy:

{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "Chrome DevTools",
      "version": "120.0.6099.109"
    },
    "browser": {
      "name": "Chrome",
      "version": "120.0.6099.109"
    },
    "pages": [...],
    "entries": [...]
  }
}

The entries array is the heart of the file. Each entry represents one HTTP transaction:

{
  "startedDateTime": "2024-01-15T10:23:45.123Z",
  "time": 287.4,
  "request": {
    "method": "POST",
    "url": "https://api.example.com/convert",
    "httpVersion": "HTTP/2",
    "headers": [
      {"name": "Content-Type", "value": "application/json"},
      {"name": "Authorization", "value": "Bearer eyJhbGc..."}
    ],
    "queryString": [],
    "cookies": [],
    "headersSize": 512,
    "bodySize": 1024,
    "postData": {
      "mimeType": "application/json",
      "text": "{\"file_id\": \"abc123\", \"target\": \"pdf\"}"
    }
  },
  "response": {
    "status": 202,
    "statusText": "Accepted",
    "httpVersion": "HTTP/2",
    "headers": [
      {"name": "Content-Type", "value": "application/json"},
      {"name": "X-Request-Id", "value": "req_7f8a9b2c"}
    ],
    "cookies": [],
    "content": {
      "size": 248,
      "mimeType": "application/json",
      "text": "{\"job_id\": \"job_xyz789\", \"status\": \"pending\"}"
    },
    "redirectURL": "",
    "headersSize": 256,
    "bodySize": 248
  },
  "timings": {
    "blocked": 0.5,
    "dns": 12.3,
    "connect": 45.2,
    "ssl": 31.1,
    "send": 0.8,
    "wait": 185.7,
    "receive": 11.8
  }
}

Timing Breakdown

The timings object breaks response time into phases:

• blocked — time waiting for a network connection slot (browser connection limit)
• dns — DNS resolution time
• connect — TCP connection establishment
• ssl — TLS handshake time
• send — time to send the request
• wait — time from sending request to receiving first byte (TTFB — Time to First Byte)
• receive — time to download the response body

Total time = blocked + dns + connect + ssl + send + wait + receive.

How to Export a HAR File

Chrome / Edge:

1. Open Developer Tools (F12 or Ctrl+Shift+I)
2. Navigate to the Network tab
3. Reproduce the issue or page load
4. Right-click any request → "Save all as HAR with content"
5. Or click the download icon in the toolbar

Firefox:

1. Open Developer Tools → Network tab
2. Right-click → "Save All As HAR"

Safari:

1. Develop menu → Show Web Inspector → Network tab
2. Export icon → Export HAR

Programmatic capture:

• Playwright and Puppeteer: page.route() intercept + manual HAR building, or built-in page.routeFromHAR() / recording APIs
• mitmproxy: mitmdump -w output.har captures traffic at the proxy level, including non-browser apps
• Charles Proxy: File → Export Session → HAR

Use Cases for HAR Files

Web Performance Analysis

HAR files are the input format for tools like:

• WebPageTest — accepts HAR upload for analysis and waterfall chart generation
• HAR Analyzer (Google) — identifies slow requests, high payload sizes, redirect chains
• GTmetrix — HAR export for offline analysis
• PageSpeed Insights — ingests HAR for Lighthouse-style auditing

The waterfall chart generated from HAR data shows request dependencies and parallel loading, making it easy to identify render-blocking resources, slow TTFB, and download bottlenecks.

API Debugging

HAR files capture exact request/response pairs including:

• All request headers (including auth tokens, cookies, custom headers)
• Exact request bodies (JSON, form data, multipart)
• Full response bodies
• Status codes and timing data

This makes them invaluable for debugging intermittent API failures. Export a HAR during the failure, share it with the API team, and they see exactly what the client sent and what the server returned.

Replay and Testing

Tools can replay HAR traffic:

• Playwright: page.routeFromHAR('recording.har') makes tests use recorded responses instead of hitting the real API — deterministic test execution without flakiness
• hurl: Command-line HTTP testing tool that can convert HAR to test scenarios
• Postman: Import HAR → automatically creates a Postman collection from all captured requests

Security Auditing

Security tools use HAR files to:

• Review all headers sent (spot leaked tokens, missing security headers)
• Identify HTTP (non-HTTPS) requests in a page load
• Find mixed content issues
• Detect overly verbose error responses leaking stack traces
• OWASP ZAP can import HAR files for passive scanning

Sensitive Data Warning

HAR files contain everything the browser sent and received, including:

• Authorization headers with bearer tokens or API keys
• Session cookies (which allow session hijacking if stolen)
• Request bodies with passwords, PII, or payment data
• Response bodies with user data or internal system information

Never share raw HAR files in public bug trackers, GitHub issues, or support tickets. Sanitize them first using:

• HAR Sanitizer (har-sanitizer npm package) — redacts auth headers, cookies, and response bodies based on configurable rules
• Google's HAR Sanitizer — web-based tool that strips sensitive fields
• Manual inspection with a text editor (HAR is just JSON)

Processing HAR Files Programmatically

Since HAR is plain JSON, any language can parse it:

import json

with open('traffic.har', 'r') as f:
    har = json.load(f)

entries = har['log']['entries']

# Find all slow requests (>500ms)
slow = [e for e in entries if e['time'] > 500]

# Find failed requests
failed = [e for e in entries if e['response']['status'] >= 400]

# Calculate total transferred bytes
total_bytes = sum(e['response']['bodySize'] for e in entries if e['response']['bodySize'] > 0)

# Extract all unique API endpoints
endpoints = set(e['request']['url'] for e in entries)

const har = JSON.parse(fs.readFileSync('traffic.har', 'utf8'));
const entries = har.log.entries;

// Group timings by domain
const byDomain = entries.reduce((acc, e) => {
  const domain = new URL(e.request.url).hostname;
  acc[domain] = (acc[domain] || 0) + e.time;
  return acc;
}, {});

HAR File Size Considerations

HAR files can grow very large because they capture full response bodies. A single page load of a modern web application can produce a 5–50 MB HAR file. Response bodies for images, fonts, and scripts are base64-encoded inline in the JSON.

To reduce size:

• Filter to specific requests before exporting (check the box "Preserve log" and filter by domain)
• Use a proxy that captures only headers, not bodies, for performance analysis
• Strip binary content types (images, fonts, videos) from HAR files using the HAR sanitizer

HAR's combination of human-readability, universal browser support, and rich timing data makes it the go-to format for diagnosing web performance issues, debugging API integrations, and auditing HTTP traffic — a small but mighty file format that every web developer should know.

Related conversions

Archive format conversions used most often:

• RAR to ZIP
• 7Z to ZIP
• TAR to ZIP
• GZ to ZIP
• ZIP to RAR
• ISO to ZIP