HTTP Archive is JSON that records browser requests, responses, timing phases, and page metadata for a captured session.

Why can HAR timing differ from DevTools?

HAR fields are exported observations and can omit browser-internal detail. Cache, connection reuse, extensions, and capture timing also change the trace.

Is a HAR safe after cookies are removed?

Not automatically. URLs, headers, payloads, and response bodies can still contain tokens, identifiers, or private application data.

Web engineering

HAR & HTTP Session Inspector

Inspect request waterfalls and redact sensitive HTTP archive fields locally.

Online tools Pricing

Input0 characters

Result0 characters

Prefer a native workflow?

Keep HAR & HTTP Session Inspector one shortcut away.

DevSexy for Mac puts the same private workflow in a focused desktop app, with global shortcuts and no browser tab to manage.

Global shortcutOffline-readyLocal processing

Try the Mac app free

This browser tool remains free.

Read the trace before blaming the network

HAR File Analyzer Online — Inspect Waterfalls, Timing & Secrets

Analyze a HAR file online to find where request time accumulated, inspect connection and response details, and identify sensitive fields before sharing the archive.

One bar, six different kinds of waiting

waterfall anatomy

QueueBrowser scheduling and connection limits

DNSHostname lookup

Connect + TLSTransport and certificate setup

RequestUpload time

WaitTime to first byte

DownloadResponse transfer

Reduce the session to the requests that can answer your question

Status4xx · 5xx

Failures and server errors

Typefetch · xhr

Application API traffic

Duration> 1,000 ms

Slow entries, not necessarily slow servers

Domainapi.example.test

First-party or third-party boundary

Before sharing

Bodies are only one place secrets hide.

Authorization and Proxy-Authorization
Cookie and Set-Cookie
Query tokens and signed URLs
Request and response bodies
Client IPs, email addresses, and account IDs

Redaction creates a new export. It does not alter the source pasted into this browser tab.

Turn one entry into a reviewable cURL request

A generated command can reproduce method, URL, headers, and body for a selected entry. Review credentials and environment-specific headers before running it.

curl 'https://api.example.test/orders' \
  -H 'accept: application/json' \
  --data-raw '{"limit":20}'

What the waterfall can and cannot prove

Can show

It can show observed browser timings, redirects, cache state, payload sizes, status codes, and request dependencies.

Cannot prove

It cannot prove the server-side root cause, replay application state safely, or guarantee a redacted file contains no sensitive business data.

HAR analysis questions

What is a HAR file?: HTTP Archive is JSON that records browser requests, responses, timing phases, and page metadata for a captured session.
Why can HAR timing differ from DevTools?: HAR fields are exported observations and can omit browser-internal detail. Cache, connection reuse, extensions, and capture timing also change the trace.
Is a HAR safe after cookies are removed?: Not automatically. URLs, headers, payloads, and response bodies can still contain tokens, identifiers, or private application data.

Run a reproducible example

Summarize a one-request capture and inspect exactly what the sanitizer changes.

Using an example replaces the current input, reference input, operation, and options. Public demonstration data only.

Summarize one recorded request

The synthetic HAR records one HTTP 200 JSON response with two response-content bytes.

Input

{"log":{"version":"1.2","creator":{"name":"Public example","version":"1"},"entries":[{"startedDateTime":"2026-01-05T09:00:00.000Z","time":24,"request":{"method":"GET","url":"https://api.example.test/items","headers":[{"name":"Authorization","value":"Bearer public-demo"}],"cookies":[],"queryString":[]},"response":{"status":200,"headers":[],"cookies":[],"content":{"size":2,"mimeType":"application/json","text":"[]"}},"timings":{"send":1,"wait":20,"receive":3}}]}}

The report counts captured entries and content sizes; it does not replay the request.

1 requests · 2 response bytes
application/json

Redact a header and body

Keep bodies is off. The public Authorization demonstration value and response body are replaced.

Input

{"log":{"version":"1.2","creator":{"name":"Public example","version":"1"},"entries":[{"startedDateTime":"2026-01-05T09:00:00.000Z","time":24,"request":{"method":"GET","url":"https://api.example.test/items","headers":[{"name":"Authorization","value":"Bearer public-demo"}],"cookies":[],"queryString":[]},"response":{"status":200,"headers":[],"cookies":[],"content":{"size":2,"mimeType":"application/json","text":"[]"}},"timings":{"send":1,"wait":20,"receive":3}}]}}

Inspect the generated JSON. The sanitizer does not guarantee that every URL or custom field is secret-free.

[REDACTED]
[REDACTED BODY]

Continue with a related task

cURL & HTTP Message Studio

Inspect cURL commands and translate requests into clear client code.

URL Inspector & Query Editor

Separate, edit, encode, and rebuild every URL component.

JSON Formatter & Validator

Format, validate, minify, inspect, and query JSON with precise syntax diagnostics.

Repeat the task in DevSexy for Mac

Use the native app for repeated offline work and direct Option shortcuts.

Direct answer

What is HAR & HTTP Session Inspector?