HARscope

HARscope

How to create a HAR file

Open the Network panel, reproduce the problem, export. The details differ a little per browser, and one setting decides whether your cookies go in the file.

HARscope runs here

Loading…

Before you start, in every browser

  1. Open the page where the problem happens, but do not reproduce it yet.
  2. Open developer tools: F12, or Ctrl+Shift+I on Windows and Linux, Cmd+Option+I on a Mac. Go to the Network tab.
  3. Turn on Preserve log (Firefox calls it Persist Logs) so a redirect or sign-in does not wipe the list.
  4. Now reproduce the problem: reload, click the button, submit the form. Wait until it has failed or finished.
  5. Export, as below. Keep the file to the one problem; a recording of a whole morning is hard for anyone to read.

Google Chrome

  1. In the Network panel's action bar, click the download arrow, Export HAR (sanitized), and save the file.
  2. Or right-click any request and choose Save all as HAR (sanitized).

Chrome's documentation says the sanitized export leaves out sensitive headers such as Cookie, Set-Cookie and Authorization. If support specifically needs them, turn on Settings → Preferences → Network → Allow to generate HAR with sensitive data; the Export button then offers Export HAR (with sensitive data). Only do that if you will redact the file before sending it.

Microsoft Edge

Edge uses the same DevTools as Chrome. Click Export HAR (sanitized) in the Network tool's action bar, or right-click a request and use Copy → Copy all as HAR (sanitized). Microsoft's documentation describes the same Allow to generate HAR with sensitive data checkbox in Settings → Preferences → Network for a full export.

Mozilla Firefox

  1. Open the Network Monitor (Ctrl+Shift+E on Windows and Linux, Cmd+Option+E on a Mac).
  2. In the menu of other actions at the right of the Network toolbar, tick Persist Logs.
  3. Reproduce the problem, then choose Save All as HAR from the same menu. Copy All as HAR puts it on the clipboard instead.

Firefox's documentation describes no sanitizing step, so expect cookies and tokens to be in the file.

Safari on a Mac

  1. Turn on the developer tools once: Safari → Settings → Advanced, tick Show features for web developers (older versions: Show Develop menu in menu bar).
  2. Choose Develop → Show Web Inspector and open the Network tab.
  3. Tick Preserve Log, reproduce the problem, then click Export (Cmd+S).

As with Firefox, Safari's documentation does not describe a sanitized export, so treat the file as containing your session.

Phones

Mobile browsers have no Network panel of their own. For Chrome on Android, connect the phone by USB, open chrome://inspect on a computer, and inspect the tab; the Network panel and its export work as above. For Safari on iPhone or iPad, turn on Web Inspector in the device's Safari advanced settings, connect it to a Mac, and open the page from Safari's Develop menu on the Mac.

Before you send it

A HAR exported with sensitive data contains your live session. Anyone holding it can act as you until the session expires. Drop it into HARscope, open the Sanitise tab, check what will be removed, and download the redacted copy. Cookies, Authorization headers, API keys, JWTs, emails and passwords in form posts are taken out in your browser. How the redaction works.

Even a sanitized export from Chrome or Edge can carry tokens outside those three headers: in URLs (?access_token=, signed links), in custom headers like X-API-Key, or in request and response bodies. Running it through the sanitiser catches the common cases.

Related: Sanitize a HAR file before you share it · Open a HAR file and read it