HAR File Viewer & Analyzer
Load a HAR (HTTP Archive) file exported from Chrome, Firefox, Safari, Charles or Fiddler. See every request with status, type, size and timing on a waterfall, drill into headers, cookies, payloads and responses, copy a request as cURL, and strip credentials before you share the file.
Private by design: anything you enter is processed in your browser only. It is never uploaded to or logged on our servers. HAR files usually contain session cookies, Authorization headers and API tokens. This viewer reads the file locally and never uploads it, and share links include only your filter and sort settings, never the HAR data. Sanitize the file before you attach it to a ticket or send it to anyone.
Sanitize removes the Cookie, Set-Cookie, Authorization and Proxy-Authorization headers and the parsed cookie lists. Tokens in URLs, request bodies or responses are not touched (unless you tick the box above); use the secrets & PII scrubber for those.
About HAR files
A HAR (HTTP Archive) file is a JSON log of everything a browser sent and received while a page was open: each request's URL, method, headers, cookies and body, each response's status, headers and (optionally) content, and a timing breakdown for every phase of the connection. Support teams ask for HAR files because they capture the exact failing request, including the headers and payload that a screenshot cannot show.
This viewer lists every entry with its status, resource type, transfer size (bytes on the wire, including headers) and content size (the uncompressed body), plus when it started relative to the first request and how long it took. Sort by any column to find the slowest or largest requests, filter by type or status class to focus on failing API calls, and open an entry to read its headers, query string, cookies, request payload and response body. JSON payloads are pretty-printed and base64-encoded response bodies are decoded automatically.
HAR files are sensitive. They routinely contain session cookies, bearer tokens and form fields such as passwords, and anyone holding a fresh session cookie can act as you. Use Sanitize HAR to download a copy without cookies and Authorization headers, review it, and run anything that still contains personal data through the secrets & PII scrubber. Sign out after recording to invalidate the session the HAR captured.
Related tools: decode tokens from Authorization headers with the JWT decoder, format payloads with the JSON beautifier, extract fields from API responses with the JSONPath tester, and decode encoded query strings with the URL encoder & decoder.
Reference Guide
How to record a HAR file:
| Browser | Steps |
|---|---|
| Chrome / Edge | Open DevTools (F12 or Ctrl+Shift+I, Cmd+Option+I on macOS) → Network tab. Tick Preserve log (and Disable cache to see every download). Reload and reproduce the problem, then click the Export HAR (download arrow) button in the Network toolbar, or right-click any request → Save all as HAR (older versions: Save all as HAR with content). Recent Chrome versions sanitize the export by default and leave out sensitive data such as cookies; to include it, enable Allow to generate HAR with sensitive data in DevTools Settings → Preferences → Network. |
| Firefox | Open DevTools (F12) → Network tab. Enable Persist Logs in the settings (gear) menu, reproduce the problem, then right-click any request → Save All As HAR. |
| Safari | Enable the Develop menu (Settings → Advanced → Show features for web developers, or Show Develop menu in older versions). Open Web Inspector (Cmd+Option+I) → Network tab, tick Preserve Log, reproduce the problem, then click Export in the Network toolbar. |
HAR 1.2 structure (fields this viewer reads):
| Path | Contains |
|---|---|
log.version, log.creator | Format version (1.2) and the tool that wrote the file |
log.pages[] | id, title, startedDateTime, pageTimings.onContentLoad and onLoad (ms after the page started, -1 if unknown) |
log.entries[] | One per request: pageref, startedDateTime, time (total ms), request, response, cache, timings, serverIPAddress |
request | method, url, httpVersion, headers[], cookies[], queryString[], postData (mimeType, text or params[]), headersSize, bodySize |
response | status, statusText, headers[], cookies[], content (size, mimeType, text, optional encoding: "base64"), redirectURL, headersSize, bodySize |
_resourceType, _transferSize, _error | Chrome extensions (underscore = custom field): resource type, bytes over the network, and the network error for failed requests |
Timing phases (entry.timings, in milliseconds):
| Phase | Meaning |
|---|---|
blocked | Time spent in a queue waiting for a network connection (connection limits, lower priority) |
dns | DNS resolution |
connect | Creating the TCP connection. Includes ssl when present |
ssl | TLS handshake. Already counted inside connect, so it is not added again to the total |
send | Sending the request to the server |
wait | Waiting for the first byte of the response (server think time plus latency; often called TTFB) |
receive | Downloading the response |
A value of -1 means the phase does not apply, for example dns and connect on a reused keep-alive connection. send, wait and receive are always present, and entry.time is the sum of all applicable phases except ssl.
Example input
{
"log": {
"version": "1.2",
"creator": { "name": "WebInspector", "version": "537.36" },
"entries": [{
"startedDateTime": "2024-05-14T10:15:30.512Z",
"time": 142.6,
"request": { "method": "GET", "url": "https://shop.example.com/api/v1/session", "headers": [] },
"response": { "status": 200, "content": { "size": 312, "mimeType": "application/json" } },
"timings": { "blocked": 1.2, "dns": -1, "connect": -1, "ssl": -1, "send": 0.4, "wait": 131, "receive": 10 }
}]
}
}
This sample loads automatically when you open the tool. Use Load Sample to bring it back.
Frequently Asked Questions
A HAR (HTTP Archive) file is a JSON recording of every network request a browser made while loading a page, including headers, bodies and timings. Browser DevTools can export one from the Network panel.
Not as is. HAR files often contain cookies, Authorization headers and session tokens. Use the sanitize option to remove them before sending a HAR to anyone.
No. It is read and analysed in your browser and is never included in share links.
Related Tools
All QA & Testing Tools →SOAP Message Viewer & Request Builder
Format and inspect SOAP 1.1 and 1.2 envelopes, read headers,...
XPath & CSS Selector Tester
Test XPath expressions and CSS selectors against your HTML o...
Gherkin Formatter & Validator
Format and validate Gherkin feature files for Cucumber, Spec...
Web Server Config Generator
Generate Nginx server blocks and Apache .htaccess rules for...
CSP Header Builder
Build a Content-Security-Policy header directive by directiv...
SPF, DKIM & DMARC Record Generator
Generate and check SPF, DKIM and DMARC DNS TXT records for e...