What is a HAR file? How to capture one and share it safely

A HAR (HTTP Archive) file is a JSON log of every request a browser page made, with its headers, bodies and timing. Developers and support teams ask for one because it shows exactly which request failed and what the server answered. This guide covers what is inside, how to capture one in each browser, how to read it, and how to clean it before you send it.

What’s inside a HAR file

A HAR file is plain JSON. Everything sits under one log object with three main parts:

• creator: the browser or tool that wrote the file, and its version.
• pages: the pages that were open during the capture, with their titles and load timings.
• entries: one object per request, in the order they started.

Each entry holds:

• startedDateTime: when the request started.
• request: the method, url, headers, cookies, queryString and, for requests that sent a body, postData.
• response: the status, headers and content, which can include the response body as text.
• timings: how long each phase took, such as DNS, connect, waiting for the server and receiving the response.

Here is one trimmed entry. The request and the API are invented, to show the shape.

{
  "startedDateTime": "2026-10-20T09:14:03.512Z",
  "request": {
    "method": "POST",
    "url": "https://api.example.com/api/profile",
    "headers": [
      { "name": "Content-Type", "value": "application/json" }
    ],
    "cookies": [],
    "queryString": [],
    "postData": {
      "mimeType": "application/json",
      "text": "{\"name\":\"Ana\",\"phone\":\"064 123 4567\"}"
    }
  },
  "response": {
    "status": 422,
    "statusText": "Unprocessable Entity",
    "headers": [
      { "name": "Content-Type", "value": "application/json" }
    ],
    "content": {
      "mimeType": "application/json",
      "text": "{\"error\":\"phone must be in E.164 format\"}"
    }
  },
  "timings": { "blocked": 2, "dns": 0, "connect": 0, "send": 1, "wait": 84, "receive": 3 }
}

The format is a W3C draft that was never finalized. Every major browser still exports it, and most proxy and debugging tools read it, so in practice it is the standard way to pass network traffic from one person to another.

How to capture a HAR file

Open DevTools before you reproduce the bug. Requests made before the Network tab was open are not recorded.

Chrome and Edge

1. On the page with the bug, press F12, or Cmd+Option+I on a Mac, to open DevTools.
2. Go to the Network tab.
3. Tick Preserve log, so requests survive a page change or a redirect.
4. Reload the page, then reproduce the bug.
5. Click the download icon in the Network toolbar (Export HAR) and save the file.

Recent Chrome versions export a sanitized HAR by default, which leaves out the Cookie, Set-Cookie and Authorization headers, and offer a separate option to export it with sensitive data. Tokens in URLs, other headers, and request and response bodies are still in the file either way.

Firefox

1. Press F12, or Cmd+Option+I on a Mac, and go to the Network tab.
2. Reproduce the bug.
3. Open the gear menu in the Network toolbar, or right-click any request, and choose Save All As HAR.

Safari

1. Turn on the Develop menu: open Safari → Settings → Advanced and tick Show features for web developers.
2. Open Develop → Show Web Inspector and go to the Network tab.
3. Reproduce the bug.
4. Click Export in the Network tab and save the file.

Is it safe to share a HAR file?

No, not as it is. A HAR file records what the browser sent and received, and that usually includes secrets:

• Session cookies that let anyone holding them act as you.
• Bearer tokens and API keys in headers or URLs.
• Passwords and other values you typed into forms while the capture ran.
• Personal data in request and response bodies: names, emails, addresses, order details.

Logging out before you share does not make the file safe. Tokens in the file may still be valid, and the bodies still hold whatever data was loaded.

Caution

Treat a HAR file like a password. Anyone who gets it can read the data in it, and may be able to use the session or keys it contains.

Clean a HAR file before you share it

1. Capture only what is needed. Start the capture right before the bug and stop right after it. Use a test account if you can.
2. Search the file. Open it in a text editor and search for authorization, cookie, token, password, apikey and Bearer.
3. Replace the values. Swap each secret for [redacted], keeping the names so the developer can see what was sent. A HAR sanitizer tool can do this for you.
4. Share it privately. Send it through a private channel or a restricted ticket, not a public issue or forum.
5. Rotate anything that leaked. If a live password, token or key ended up somewhere it shouldn’t, change it.

How to open and read a HAR file

To open one, drag the file into the Network tab of Chrome DevTools, or use the import button in its toolbar. The requests show as if you had recorded them. Faylee’s free HAR file viewer works too: it lists failed requests first, copies any request as cURL, and reads the file in your browser without uploading it. Since the file is JSON, any text editor opens it as well.

Look at these first:

1. Status codes of 400 and above. Sort or filter by status. A 4xx usually means the request was wrong, a 5xx means the server failed.
2. Failed or blocked requests. Requests with no status, cancelled ones, or ones the browser blocked for CORS.
3. Slow timings. A long wait points at the server. A long blocked or connect points at the network.
4. The response body of the failing call. The error message is often there, in words.

A worked example

This example is invented. A user reports that saving their profile “does nothing”. In the HAR, POST /api/profile returns 422. The request body sent "phone":"064 123 4567", and the response body says:

{"error":"phone must be in E.164 format"}

The server is doing its job. The bug is on the client: the form accepts a local phone format and doesn’t show the server’s error. The fix is to format or validate the number before sending it, and to show the message when the server rejects it.

Skip the HAR: record the bug with Faylee

Walking someone through DevTools, exporting and cleaning is slow. Faylee’s Chrome extension, which also works in Edge, Brave and Arc, records the network requests of the page with their headers and timing while you show the bug. Request and response bodies are captured for fetch and XMLHttpRequest requests.

Secrets are hidden in the browser before upload: authorization, cookie, set-cookie, API-key and CSRF headers, sensitive keys in bodies and query parameters, and JWTs and Bearer or Basic credentials wherever they appear. You can mask parts of your own page with data-faylee-mask. See Privacy and redaction.

In the viewer, cURL copies a request as a curl command, and HAR downloads every request in the recording as a HAR file, also available from the player’s Download menu. Coding agents such as Claude Code, Codex and Cursor can read the same requests through Faylee’s MCP server.

To try it, start free, or see pricing.

FAQ

What does HAR stand for?

HTTP Archive. It is a JSON format for recording the HTTP requests and responses a browser made.

Can a HAR file contain passwords?

Yes. If you typed a password into a form while the capture was running, it is in the request body of that form’s request. Search the file before you share it.

How big can a HAR file get?

There is no fixed limit. A short capture of a few API calls is small, but a long session with images, video or large responses can reach many megabytes.

Can I open a HAR file without Chrome?

Yes. It is JSON, so any text editor opens it. Firefox’s network tools and online HAR viewers, such as Faylee’s HAR file viewer, show it as a request list.

Sources

• Network features reference, Chrome DevTools
• Network Monitor, Firefox DevTools
• HTTP Archive (HAR) format, W3C draft