What is the HAR file format?
A .har file - short for HTTP Archive - is a JSON-based log that records every HTTP request and response exchanged during a browser session. Browsers, proxies, and performance-monitoring tools export .har files so developers and support engineers can replay, inspect, and analyze network activity offline.
The format originated around 2007 as the export format of Firebug's Net panel and was later formalized in a W3C Editor's Draft in 2012. HAR 1.2 is the version written by all major browsers today: Chrome, Edge, Firefox, and Safari all include a Save all as HAR option in their DevTools Network tab.
Internally, a .har file is a single JSON object with one top-level key - log - containing:
version- always1.2in modern exports (older tools wrote1.1)pages[]- one entry per page load, with overall load timingentries[]- one entry per HTTP request/response pair, including URL, method, status code, headers, cookies, posted form data, and per-stage timings (DNS lookup, TCP connect, TLS handshake, send, wait, receive)
Because .har files store all of this as plain UTF-8 text, they can contain sensitive data such as session cookies, authorization tokens, and full response bodies. Treat them like credentials before sharing publicly or attaching to a support ticket.
Support teams at services including Microsoft 365, Okta, Zendesk, and Cloudflare routinely ask users to record and attach a .har file to help diagnose login failures, slow page loads, and API errors. Security researchers also load .har exports into tools like Fiddler or Wireshark to inspect and replay captured sessions.
Files grow quickly: a simple page load may produce 200 KB-2 MB; recording a complex session for several minutes can exceed 100 MB. The format has no built-in compression, though .har files are routinely gzipped externally for storage or transfer. Any text editor can open them - since they are plain JSON - and dedicated analyzers such as the Google Admin Toolbox HAR Analyzer present the data as interactive waterfall tables of requests and responses.
Security & safety
RISK: HIGHThe danger of a HAR is not malware but EXPOSURE. A HAR captures everything the browser sent and received in clear text: session cookies, OAuth/bearer tokens, API keys, CSRF tokens, full POST bodies and sometimes typed passwords. Anyone who obtains the file can often replay the user's authenticated session. High-profile incidents (e.g. the 2023 Okta support-system breach, where stolen HAR files contained session tokens) make this concrete. Before sharing a HAR: generate it WITHOUT response content where possible, and run it through a sanitizer (e.g. Cloudflare/Google 'HAR sanitizer' or the har-sanitizer tool) to strip cookies, Authorization headers and tokens. Never post a raw HAR in a public ticket, forum or chat. The file itself does not execute, so opening one to READ it is safe.
Format details
in a nutshell- Resource Interchange Audio (legacy .HAR) - A few old DOS-era games used .har for packed audio/resource archives; unrelated to HTTP Archive.
Programs that open HAR files
Windows5 apps
Google Admin Toolbox HAR Analyzer
Free Open the site in a browser, drag the .har onto the page - it renders a timeline and per-request detail entirely client-side (file is not uploaded).
Google Chrome / Microsoft Edge DevTools
Free Press F12, open the Network tab, right-click in the request list, choose 'Import HAR file' (or drag the .har onto the panel) to replay the waterfall. 
Visual Studio Code
Free Open the .har as JSON; use Format Document and folding to read it. The 'HAR Viewer' extension adds a structured view.
Notepad / any text editor
Open-source Open as text - it's JSON. Use a JSON plugin to pretty-print before reading.
Fiddler Everywhere
Freemium File to Import to HAR - loads the capture into Fiddler's inspectors for replay and analysis. 
macOS2 apps
Safari Web Inspector
Built-in Enable the Develop menu, open Web Inspector to Network, then import the HAR; or use the Google HAR Analyzer in any browser. 
Linux2 apps
Google Admin Toolbox HAR Analyzer
Free The standard no-install viewer recommended by many support desks; processes the file locally in your browser. Technical details
deep spec| Container format | JSON (plain text, UTF-8) |
| MIME type | application/json; also registered as application/har+json |
| File signature | None - identified by JSON structure; file almost always begins with {"log":{"version":"1.2" |
| Internal version field | log.version field: "1.2" in all modern exports; older tools wrote "1.1" |
| Top-level schema | {log:{version, creator, browser, pages[], entries[]}} - one entries[] item per HTTP request/response pair |
| Per-entry timing fields | Millisecond-resolution per stage: dns, connect, ssl, send, wait (TTFB), receive - enables waterfall chart analysis |
| Binary content handling | Binary response bodies are base64-encoded inside the JSON text field |
| Compression | None built-in; commonly gzipped externally as .har.gz for storage or transfer |
| Privacy sensitivity | High - stores cookies, authorization headers, auth tokens, and full request/response bodies in clear text |
| Typical file size | 200 KB - 50 MB per session; media-heavy or extended sessions can exceed 100 MB |
| Platform support | Exported by Chrome, Edge, Firefox, and Safari DevTools; imported by Charles Proxy, Fiddler, Proxyman, and others |
| Primary use cases | Performance analysis, web debugging, support diagnostics (Microsoft 365, Okta, Zendesk, Cloudflare), and HTTP traffic auditing |
| Entry count limit | Unbounded - the entries array grows with each request captured; limited only by available memory |
| Released | 2007 (HAR 1.1 draft, Firebug Net panel); W3C draft 'HTTP Archive (HAR) format' 2012 |
| Latest version | HAR 1.2 (the version recorded inside every modern export's log.version field) |
| Open standard | Yes · royalty-free |
| Specification | www.softwareishard.com |
HAR conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about HAR files.
