HAR Analyzer

How to Read a HAR File: Timings, Status Codes and What to Look For

Updated

A HAR (HTTP Archive) file is a JSON log of every request a browser made while a page was open. Support teams ask for it because it shows what actually happened on your machine. Here is how to read one without a tool, and what a viewer does for you.

What is inside a HAR file

The file has one log object with a version (1.1 or 1.2), the creator (the browser or proxy that wrote it), an optional list of pages and the entries array. Each entry is one request: startedDateTime, the total time in milliseconds, the request (method, URL, headers, cookies, query string, post data), the response (status, headers, cookies, content with size, MIME type and often the body text), cache information and a timings object. The spec requires UTF-8 and allows a comment on almost every object. Chrome adds fields with an underscore prefix, such as _initiator and _priority, which other tools ignore.

What the timing phases mean

Every entry splits its time into blocked (queued or waiting for a connection), dns, connect, ssl (part of connect in HAR 1.2), send, wait and receive. Wait is the time from the last byte sent to the first byte received, so a large wait points at the server or at something in front of it. A large receive with a big body points at transfer size. A large blocked value on many small requests usually means the browser hit its connection limit for one host. A value of -1 means the phase did not apply, which is common in proxy exports.

What to look for first

Start with status codes: anything 4xx or 5xx, and status 0, which in Chrome means the request was blocked, cancelled or failed at the network level. Then sort by duration and look at the top ten; a single request of several seconds is a clearer lead than a hundred fast ones. Then sort by size. Then look for redirect chains (a 301 or 302 followed by the same path) and duplicate requests to the same URL. Before sending the file to anyone, remove Authorization and Cookie headers and any tokens in URLs or bodies, or use a cleaner that does it locally.

Open the tool

Sources