Guide

HAR Files: HTTP Archive Format for Web Performance and API Debugging

PC By Pablo Cirre • Updated May 7, 2026

HAR Files: Capturing and Analyzing HTTP Traffic

HAR (HTTP Archive) is a JSON-based format for recording HTTP request and response data. When you open a browser's Developer Tools, navigate to the Network tab, and export the captured traffic, the result is a .har file. This single file contains a complete record of every HTTP transaction — URLs, headers, cookies, request bodies, response bodies, timings, and status codes — making HAR the universal format for web performance analysis, API debugging, and security auditing.

HAR File Structure

A HAR file is a JSON document with a strict hierarchy:

{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "Chrome DevTools",
      "version": "120.0.6099.109"
    },
    "browser": {
      "name": "Chrome",
      "version": "120.0.6099.109"
    },
    "pages": [...],
    "entries": [...]
  }
}

The entries array is the heart of the file. Each entry represents one HTTP transaction:

{
  "startedDateTime": "2024-01-15T10:23:45.123Z",
  "time": 287.4,
  "request": {
    "method": "POST",
    "url": "https://api.example.com/convert",
    "httpVersion": "HTTP/2",
    "headers": [
      {"name": "Content-Type", "value": "application/json"},
      {"name": "Authorization", "value": "Bearer eyJhbGc..."}
    ],
    "queryString": [],
    "cookies": [],
    "headersSize": 512,
    "bodySize": 1024,
    "postData": {
      "mimeType": "application/json",
      "text": "{\"file_id\": \"abc123\", \"target\": \"pdf\"}"
    }
  },
  "response": {
    "status": 202,
    "statusText": "Accepted",
    "httpVersion": "HTTP/2",
    "headers": [
      {"name": "Content-Type", "value": "application/json"},
      {"name": "X-Request-Id", "value": "req_7f8a9b2c"}
    ],
    "cookies": [],
    "content": {
      "size": 248,
      "mimeType": "application/json",
      "text": "{\"job_id\": \"job_xyz789\", \"status\": \"pending\"}"
    },
    "redirectURL": "",
    "headersSize": 256,
    "bodySize": 248
  },
  "timings": {
    "blocked": 0.5,
    "dns": 12.3,
    "connect": 45.2,
    "ssl": 31.1,
    "send": 0.8,
    "wait": 185.7,
    "receive": 11.8
  }
}

Timing Breakdown

The timings object breaks response time into phases:

blocked — time waiting for a network connection slot (browser connection limit)
dns — DNS resolution time
connect — TCP connection establishment
ssl — TLS handshake time
send — time to send the request
wait — time from sending request to receiving first byte (TTFB — Time to First Byte)
receive — time to download the response body

Total time = blocked + dns + connect + ssl + send + wait + receive.

How to Export a HAR File

Chrome / Edge:

Open Developer Tools (F12 or Ctrl+Shift+I)
Navigate to the Network tab
Reproduce the issue or page load
Right-click any request → "Save all as HAR with content"
Or click the download icon in the toolbar

Firefox:

Open Developer Tools → Network tab
Right-click → "Save All As HAR"

Safari:

Develop menu → Show Web Inspector → Network tab
Export icon → Export HAR

Programmatic capture:

Playwright and Puppeteer: page.route() intercept + manual HAR building, or built-in page.routeFromHAR() / recording APIs
mitmproxy: mitmdump -w output.har captures traffic at the proxy level, including non-browser apps
Charles Proxy: File → Export Session → HAR

Use Cases for HAR Files

Web Performance Analysis

HAR files are the input format for tools like:

WebPageTest — accepts HAR upload for analysis and waterfall chart generation
HAR Analyzer (Google) — identifies slow requests, high payload sizes, redirect chains
GTmetrix — HAR export for offline analysis
PageSpeed Insights — ingests HAR for Lighthouse-style auditing

The waterfall chart generated from HAR data shows request dependencies and parallel loading, making it easy to identify render-blocking resources, slow TTFB, and download bottlenecks.

API Debugging

HAR files capture exact request/response pairs including:

All request headers (including auth tokens, cookies, custom headers)
Exact request bodies (JSON, form data, multipart)
Full response bodies
Status codes and timing data

This makes them invaluable for debugging intermittent API failures. Export a HAR during the failure, share it with the API team, and they see exactly what the client sent and what the server returned.

Replay and Testing

Tools can replay HAR traffic:

Playwright: page.routeFromHAR('recording.har') makes tests use recorded responses instead of hitting the real API — deterministic test execution without flakiness
hurl: Command-line HTTP testing tool that can convert HAR to test scenarios
Postman: Import HAR → automatically creates a Postman collection from all captured requests

Security Auditing

Security tools use HAR files to:

Review all headers sent (spot leaked tokens, missing security headers)
Identify HTTP (non-HTTPS) requests in a page load
Find mixed content issues
Detect overly verbose error responses leaking stack traces
OWASP ZAP can import HAR files for passive scanning

Sensitive Data Warning

HAR files contain everything the browser sent and received, including:

Authorization headers with bearer tokens or API keys
Session cookies (which allow session hijacking if stolen)
Request bodies with passwords, PII, or payment data
Response bodies with user data or internal system information

Never share raw HAR files in public bug trackers, GitHub issues, or support tickets. Sanitize them first using:

HAR Sanitizer (har-sanitizer npm package) — redacts auth headers, cookies, and response bodies based on configurable rules
Google's HAR Sanitizer — web-based tool that strips sensitive fields
Manual inspection with a text editor (HAR is just JSON)

Processing HAR Files Programmatically

Since HAR is plain JSON, any language can parse it:

import json

with open('traffic.har', 'r') as f:
    har = json.load(f)

entries = har['log']['entries']

# Find all slow requests (>500ms)
slow = [e for e in entries if e['time'] > 500]

# Find failed requests
failed = [e for e in entries if e['response']['status'] >= 400]

# Calculate total transferred bytes
total_bytes = sum(e['response']['bodySize'] for e in entries if e['response']['bodySize'] > 0)

# Extract all unique API endpoints
endpoints = set(e['request']['url'] for e in entries)

const har = JSON.parse(fs.readFileSync('traffic.har', 'utf8'));
const entries = har.log.entries;

// Group timings by domain
const byDomain = entries.reduce((acc, e) => {
  const domain = new URL(e.request.url).hostname;
  acc[domain] = (acc[domain] || 0) + e.time;
  return acc;
}, {});

HAR File Size Considerations

HAR files can grow very large because they capture full response bodies. A single page load of a modern web application can produce a 5–50 MB HAR file. Response bodies for images, fonts, and scripts are base64-encoded inline in the JSON.

To reduce size:

Filter to specific requests before exporting (check the box "Preserve log" and filter by domain)
Use a proxy that captures only headers, not bodies, for performance analysis
Strip binary content types (images, fonts, videos) from HAR files using the HAR sanitizer

HAR's combination of human-readability, universal browser support, and rich timing data makes it the go-to format for diagnosing web performance issues, debugging API integrations, and auditing HTTP traffic — a small but mighty file format that every web developer should know.

Related conversions

Archive format conversions used most often:

Frequently Asked Questions

TTFB stands for Time to First Byte — the time elapsed from when the browser sends a request to when it receives the first byte of the response. In HAR files, TTFB corresponds to the "wait" timing field. High TTFB (over 200ms) indicates slow server-side processing, database queries, or network latency. A good TTFB is under 100ms for cached content and under 400ms for dynamic content. TTFB is one of the most important metrics for diagnosing slow page loads because it directly affects when the browser can start rendering.

TTFB stands para Time to First Byte — the time elapsed de when o navegador sends a request to when it receives the first byte of the response. In HAR files, TTFB corresponds para o "wait" timing field. alta TTFB (over 200ms) indicates slow server-side processing, database queries, ou network latency. A bom TTFB is under 100ms para cached content e under 400ms para dynamic content. TTFB is one of the most important metrics para diagnosing slow page loads because it directly affects when o navegador can start rendering.

TTFB stands für Time to First Byte — the time elapsed von when der Browser sends a request to when it receives the first byte des response. In HAR files, TTFB corresponds zum "wait" timing field. hoch TTFB (over 200ms) indicates slow server-side processing, database queries, oder network latency. A gut TTFB is under 100ms für cached content und under 400ms für dynamic content. TTFB is one des most important metrics für diagnosing slow page loads because it directly affects when der Browser can start rendering.

TTFB stands para Time to First Byte — the time elapsed de when el navegador sends a request to when it receives the first byte del response. In HAR files, TTFB corresponds al "wait" timing field. alta TTFB (over 200ms) indicates slow server-side processing, database queries, o network latency. A bueno TTFB is under 100ms para cached content y under 400ms para dynamic content. TTFB is one del most important metrics para diagnosing slow page loads because it directly affects when el navegador can start rendering.

7z (LZMA2) typically beats both ZIP and RAR by 10–30% for text-heavy content, but is slower to create. RAR compresses slightly better than ZIP and supports recovery records (good for damaged archives) but the format is proprietary. ZIP is the universal lingua franca — every OS opens it natively. Use 7z for long-term storage, ZIP for sharing.

Not without sanitization. HAR files contain everything the browser sent and received, including Authorization headers with API keys or bearer tokens, session cookies that can be used to hijack your session, and full response bodies that may contain personal data. Before sharing, use a HAR sanitizer tool (such as the npm package har-sanitizer or Google's web-based HAR Sanitizer) to redact sensitive fields. Alternatively, open the HAR file in a text editor and manually remove headers like Authorization, Cookie, and Set-Cookie.

Not sem sanitization. HAR arquivos contain everything o navegador enviado e received, including Authorization headers com API keys ou bearer tokens, session cookies that can be used to hijack your session, e full response bodies that may contain personal data. antes sharing, usar a HAR sanitizer tool (such como o npm package har-sanitizer ou Google's web-based HAR Sanitizer) to redact sensitive fields. Alternatively, abrir the HAR arquivo em um text editor e manually remove headers like Authorization, Cookie, e Set-Cookie.

Not ohne sanitization. HAR Dateien contain everything der Browser sent und received, including Authorization headers mit API keys oder bearer tokens, session cookies that can be used to hijack your session, und full response bodies that may contain personal data. vor sharing, verwenden a HAR sanitizer tool (such als das npm package har-sanitizer oder Google's web-based HAR Sanitizer) to redact sensitive fields. Alternatively, öffnen the HAR Datei in einem text editor und manually remove headers like Authorization, Cookie, und Set-Cookie.

Not sin sanitization. HAR archivos contain everything el navegador sent y received, including Authorization headers con API keys o bearer tokens, session cookies that can be used to hijack your session, y full response bodies that may contain personal data. antes sharing, usar a HAR sanitizer tool (such como el npm package har-sanitizer o Google's web-based HAR Sanitizer) to redact sensitive fields. Alternatively, abrir the HAR archivo en un text editor y manually remove headers like Authorization, Cookie, y Set-Cookie.

Yes, when the file contains anything sensitive. Standard ZIP "encryption" (ZipCrypto) is broken and trivially crackable. Use AES-256 (ZIP 2.0+, supported by 7-Zip, WinRAR, modern Windows). Verify the encryption type when creating: many tools default to ZipCrypto for compatibility. Better still, use 7z which uses AES-256 by default.

Playwright has built-in HAR support: use page.routeFromHAR("recording.har") to serve recorded responses instead of hitting the real network, making tests deterministic. You can also record a HAR during a test with the recordHar option in browser context configuration. Postman can import a HAR file and convert it to a collection. For command-line testing, hurl and curl-based scripts can replay individual requests extracted from the HAR JSON.

Original ZIP: 4 GB total + 65,535 files. ZIP64 (transparent extension): up to 16 EB and unlimited files. Modern tools (Windows Explorer, macOS Finder, 7-Zip, Linux unzip) all support ZIP64 automatically when needed. The only catch: very old tools (pre-2007) cannot open ZIP64 archives.

HAR files embed full response bodies as base64-encoded text inside the JSON, including images, fonts, scripts, stylesheets, and API responses. A single modern web page load can produce 10-100 MB of HAR data. To reduce size: filter the Network tab to specific domains or content types before exporting, exclude media types you don't need, or use a tool like har-sanitizer to strip binary content. For performance analysis where body content isn't needed, some proxy tools can capture headers-only HAR.

HAR arquivos embed full response bodies as base64-encoded text inside the JSON, including images, fonts, scripts, stylesheets, e API responses. A single moderno web page load can produce 10-100 MB of HAR data. To reduce size: filter the Network tab to specific domains ou content types antes exporting, exclude media types Você não precisa, ou usar uma ferramenta like har-sanitizer to strip binary content. para performance analysis where body content isn't needed, some proxy ferramentas can capture headers-only HAR.

HAR Dateien embed full response bodies as base64-encoded text inside the JSON, including images, fonts, scripts, stylesheets, und API responses. A single modern web page load can produce 10-100 MB von HAR data. To reduce size: filter the Network tab to specific domains oder content types vor exporting, exclude media types Sie brauchen kein, oder verwenden a tool like har-sanitizer to strip binary content. für performance analysis where body content isn't needed, some proxy Werkzeuge can capture headers-only HAR.

HAR archivos embed full response bodies as base64-encoded text inside the JSON, including images, fonts, scripts, stylesheets, y API responses. A single moderno web page load can produce 10-100 MB de HAR data. To reduce size: filter the Network tab to specific domains o content types antes exporting, exclude media types No necesitas, o usar a tool like har-sanitizer to strip binary content. para performance analysis where body content isn't needed, some proxy herramientas can capture headers-only HAR.

Some content does not compress well: already-compressed media (JPG, MP4, MP3), encrypted files, random binary data. Compression algorithms exploit redundancy — these formats already removed it. To shrink them you would need lossy re-encoding, not archiving. Save archives for text, source code, uncompressed media (BMP, WAV, RAW), and document files.