HAR File Analyzer & Redactor

What Is a HAR File and What Does It Contain?

A HAR (HTTP Archive) file is an industry-standard JSON format used by web browsers and HTTP clients to log interactions with a web server. When you navigate a website, your browser makes dozens or hundreds of requests for HTML documents, CSS files, JavaScript, images, and API data. A HAR file records the meticulous details of every single request and response in that timeline.

Inside the JSON structure of a HAR file, you will find exhaustive data: the exact URLs requested, DNS resolution times, TCP connection times, HTTP methods (GET, POST, etc.), status codes, request headers, response headers, and often the full text content of both the request payloads and the server responses. This makes it an unparalleled tool for diagnosing HTTP headers, performance bottlenecks, missing assets, and API failures.

The Security Risks Hidden in HAR Files

The exact comprehensiveness that makes HAR files useful is what makes them extremely dangerous if mishandled. Because a HAR file represents a literal recording of your browser session, it inherently captures your active authentication credentials.

When you are logged into a platform, your browser continually sends authentication proofs—such as session cookies or Authorization headers carrying bearer tokens—with every request. The HAR file records these proofs in plain text. If you send an unredacted HAR file to a support agent, a developer, or accidentally attach it to a public GitHub issue, anyone who opens that file can extract your tokens. Until those tokens expire, malicious actors can replay them to impersonate you, bypassing MFA and gaining full access to your account.

How to Export a HAR File from Chrome, Firefox, and Safari

Exporting a HAR file is built into modern browsers. Here is how to do it:

• Google Chrome & Microsoft Edge: Open Developer Tools (F12 or Right Click > Inspect). Navigate to the "Network" tab. Ensure the round record button at the top left is red. Check the "Preserve log" box if you are debugging an issue that involves a page reload. Reproduce your issue, then right-click any row in the network grid and select "Save all as HAR with content."
• Mozilla Firefox: Open Web Developer Tools (F12). Go to the "Network" tab. Reproduce your issue. Click the gear icon in the top right of the Network panel and select "Save All As HAR."
• Apple Safari: First, enable the Develop menu (Preferences > Advanced > Show Develop menu). Open the Web Inspector (Option+Command+I) and go to the "Network" tab. Reproduce the issue, then click the "Export" icon located at the top right of the network pane.

What Headers and Data Should Always Be Redacted

Before sharing a HAR file, you must strip away any data that could be used for account takeover or expose sensitive Personal Identifiable Information (PII). Using our redaction tool, you should target:

• Authentication Headers: The Authorization header is the most critical to remove, as it often contains JWTs (JSON Web Tokens) or OAuth bearer tokens. You may also need to remove custom headers like X-API-Key or X-Auth-Token. Check your tokens with a secret scanner to understand their impact.
• Cookies: The Cookie header in requests and the Set-Cookie header in responses contain session identifiers. These must be removed.
• Request and Response Bodies: If you are debugging a login failure, the request body might contain your raw password. Response bodies might contain private user data. If the person helping you only needs to see network timings and HTTP status codes, redact the bodies entirely.
• Query Parameters: Sometimes developers mistakenly put tokens in URL query strings (e.g., ?token=abc...). While our tool focuses on headers and bodies, be mindful of URLs before sharing.

When in doubt, use a tool like a security headers builder to understand standard headers versus custom authentication mechanisms.

Why Client-Side HAR Redaction Is Essential

There are many online HAR viewers available, but uploading your HAR file to a third-party server is contradictory to security best practices. If a HAR file contains your live session cookies, uploading it to an untrusted server means you have just given that server your session.

Our HAR File Analyzer & Redactor operates entirely via client-side JavaScript. When you drag and drop your file, the browser's native File API reads it directly into your local memory. The filtering, table rendering, and string replacement logic all execute on your local CPU. When you click download, the sanitized JSON is generated entirely in the browser. Zero bytes of your trace are ever transmitted over the internet, guaranteeing complete privacy much like a secure log file anonymizer.

Using Cleaned HAR Files for Performance Analysis

Beyond debugging errors, HAR files are essential for web performance optimization. By filtering by domain in our analyzer, you can easily spot third-party scripts that are blocking the main thread or downloading excessively large payloads.

The timeline visualization helps identify "waterfall" bottlenecks—situations where assets are loading sequentially rather than in parallel. You can easily spot redirects (3xx status codes), oversized image files that might need stripping of EXIF metadata, and API endpoints with high latency. Once the sensitive data is redacted, you can safely attach these performance profiles to Jira tickets or GitHub issues for the broader engineering team to review.