Read the trace before blaming the network
HAR File Analyzer — Inspect Waterfalls, Timing and Sensitive Data
Use the waterfall to find where time accumulated, then inspect the exact entry, connection, request, response, and initiator evidence.
One bar, six different kinds of waiting
waterfall anatomyReduce the session to the requests that can answer your question
4xx · 5xxFailures and server errors
fetch · xhrApplication API traffic
> 1,000 msSlow entries, not necessarily slow servers
api.example.testFirst-party or third-party boundary
Before sharing
Bodies are only one place secrets hide.
- Authorization and Proxy-Authorization
- Cookie and Set-Cookie
- Query tokens and signed URLs
- Request and response bodies
- Client IPs, email addresses, and account IDs
Redaction creates a new export. It does not alter the source pasted into this browser tab.
Turn one entry into a reviewable cURL request
A generated command can reproduce method, URL, headers, and body for a selected entry. Review credentials and environment-specific headers before running it.
curl 'https://api.example.test/orders' \
-H 'accept: application/json' \
--data-raw '{"limit":20}'What the waterfall can and cannot prove
Can show
It can show observed browser timings, redirects, cache state, payload sizes, status codes, and request dependencies.
Cannot prove
It cannot prove the server-side root cause, replay application state safely, or guarantee a redacted file contains no sensitive business data.
HAR analysis questions
- What is a HAR file?
- HTTP Archive is JSON that records browser requests, responses, timing phases, and page metadata for a captured session.
- Why can HAR timing differ from DevTools?
- HAR fields are exported observations and can omit browser-internal detail. Cache, connection reuse, extensions, and capture timing also change the trace.
- Is a HAR safe after cookies are removed?
- Not automatically. URLs, headers, payloads, and response bodies can still contain tokens, identifiers, or private application data.