What Is a HAR File? How to Record One, Read One, and Share It Safely

Somebody asks you for a HAR file. Usually it is support, or a developer looking at a bug you reported, and usually the request arrives with instructions that assume you already know what one is.

A HAR file is a recording of every request a browser made while you were doing something, saved as a single file. HAR stands for HTTP Archive. It is a plain JSON file listing each request the page sent, what came back, how long each took, and in what order - the Network tab of your browser’s developer tools, written down and handed over.

What is inside one

For every request the page made while recording:

• The request: method, full URL, headers, query string, and the body if there was one
• The response: status code, headers, content type, size, and often the body
• Timings: how long the request waited, connected, sent, and waited for the first byte
• When it happened, so the order and the gaps between requests survive

That last part is what makes a HAR more useful than a screenshot of the network tab. A screenshot shows you a list; a HAR lets somebody replay the sequence and see that the token refresh fired after the request that needed it.

When somebody asks for one

Almost always because a problem is invisible from the outside and specific to you.

• A page loads for you and not for them, or the other way round
• Something fails silently, with nothing in the interface saying so
• A request is slow, and nobody can tell whether it is the network, the server or the browser
• An integration returns an error only in production, only for one account

In all of those, the answer is usually one line in a file nobody looked at: a 403 where a 200 was expected, a request that never fired, a redirect loop, a CORS failure that the page swallowed.

How to record one

Chrome or Edge. Open developer tools with F12, or Cmd + Option + I on a Mac. Go to the Network tab. Tick Preserve log so a redirect does not wipe what you have recorded. Reproduce the problem. Then right-click any row in the list and choose Save all as HAR with content.

Firefox. Developer tools, Network tab, reproduce, then right-click a row and choose Save All As HAR.

Safari. Enable the Develop menu in Settings, then Develop, Show Web Inspector, Network, and Export.

Two things people miss. Start recording before the thing you are demonstrating, because the network tab only holds what it saw. And reproduce the problem once and stop: a HAR of eleven minutes of clicking is a file nobody will read.

Reading one without a tool

The fastest way in is to open the file in a browser’s own network tab: drag the HAR onto the Network panel and it loads as if you had recorded it yourself, sortable and filterable.

What to look at, roughly in order:

Not this first

Scrolling the whole list looking for something that seems wrong

This first

Filter to status 400 and above, then to the slowest few requests, then look at what happened immediately before the failure

A HAR is JSON, so jq works on it too: jq '.log.entries[] | select(.response.status >= 400) | {url: .request.url, status: .response.status}' capture.har gets you the failures in one line.

The part nobody warns you about

A HAR file usually contains credentials. That is the single most important thing to know about one, and the instructions people send rarely mention it.

Saved with content, a HAR holds every request header, which means session cookies and authorization tokens, and every response body, which can include personal data belonging to whoever was signed in. Anyone who has the file can often act as that user until those tokens expire.

So:

• Treat a HAR like a password. Do not paste one into a public issue tracker, a shared channel, or an email thread that will be forwarded.
• Sanitise before sharing if you can. Some tools strip cookies and authorization headers; otherwise open the JSON and remove them by hand.
• Record in a private window with a test account where the problem allows it, which keeps real customer data out of the file entirely.
• Delete it afterwards. It is evidence for one investigation, not a document.

If you are the person asking for a HAR, say all of this in the request. Most people who send you one containing their live session token were never told not to.

Getting one without the instructions

Everything above is four paragraphs of instructions for somebody who is only trying to report that a page is broken, which is why HAR files so often do not arrive at all.

The network log it captures includes a HAR file you can download and open in developer tools, so whoever picks the report up gets the same file they would have asked for, without having had to ask. What it does not do is decide what to redact for you: the warning above still applies to anything you share.

For everything that goes around the file - what you expected, what happened, and which build it was - the bug report guide has the template.