The seven phases
The HAR 1.2 specification gives every entry a timings object in milliseconds. A value of -1 means the phase did not apply, for example no DNS lookup because the connection was reused. The entry's total time is the sum of the phases that did apply.
| Phase | What it measures | When it is long |
|---|---|---|
| blocked | Time queued in the browser waiting for a network connection | Too many requests to one host over HTTP/1.1 (about six connections each), or lower-priority requests held back |
| dns | Resolving the host name | A new third-party domain, or a slow resolver |
| connect | Opening the TCP connection | The server is far away or the network is slow |
| ssl | The TLS handshake | Same causes as connect; repeated on every new connection |
| send | Sending the request | Large uploads; otherwise nearly zero |
| wait | Waiting for the first byte of the response (TTFB) | The server is slow to answer: a database query, a cold start, an upstream API |
| receive | Downloading the response | A large payload or limited bandwidth |
One detail catches people out: the spec says the ssl time is also included in connect, for compatibility with HAR 1.1. A tool that adds connect and ssl together counts the handshake twice. HARscope subtracts it, so its TCP connect is the connection alone.
Reading the waterfall
In the Requests tab each row's bar starts at the moment the request started, measured from the first request in the file, and is coloured by phase. Two vertical lines mark DOMContentLoaded and the load event when the HAR includes page timings.
- A staircase of short bars is normal: the document loads, then its scripts and styles, then what they ask for.
- One long amber bar is a slow server response. Everything that depends on it waits. HARscope flags any wait over 600 ms and calls it serious over 1.8 s.
- Long teal tails are downloads. Check the size column: a 2 MB image or a 1.5 MB JSON response is the cause, not the network.
- Grey at the start of many bars means queuing. If the protocol column in the request detail says HTTP/1.1, moving to HTTP/2 usually removes it.
- Gaps where nothing runs are time the browser spent on something other than the network, usually running JavaScript. A HAR cannot show what; the browser's Performance panel can.
Where the time went
The Findings tab adds every phase across all requests into one bar. On most slow pages one colour dominates. Mostly amber means the backend is the bottleneck. Mostly teal means payload size. A lot of blue, yellow and violet (DNS, connect, TLS) means too many separate hosts, each needing a new connection; fewer third-party domains or preconnect hints help.
Cache and service workers
Requests served from the browser cache or a service worker often show near-zero phases, and some browsers record them with all timings at zero. They are real requests, just cheap ones. If you are measuring a cold load, tick Disable cache in the Network panel before recording.
Times are relative
A HAR records the start time of each request and how long it took, on the recording machine's clock. Throttling in DevTools, a busy laptop or a VPN all show up in the numbers. Compare HARs recorded under the same conditions, and when you send one to support, say whether throttling was on.
Related: What a HAR file can tell you is wrong · Open a HAR file and read it