{
  "schemaVersion": "1.0",
  "canonicalPage": "https://fileformat.co/ext/har",
  "inspectorUrl": "https://fileformat.co/inspect",
  "spec": {
    "slug": "har",
    "extension": ".har",
    "aliases": [],
    "name": "HTTP Archive v1.2 Capture",
    "shortName": "HAR",
    "category": "devtools-security",
    "tier": 1,
    "summary": "UTF-8 JSON network session capture exported by Chrome/Firefox/Playwright containing full HTTP headers, cookies, request payloads, and timing waterfalls.",
    "technicalNotes": "High-risk credential leak vector! Raw DevTools `.har` exports record live `Authorization: Bearer`, `Cookie`, `Set-Cookie`, and OAuth tokens in cleartext.",
    "mimeTypes": [
      "application/json"
    ],
    "identifiers": {
      "specUrl": "http://www.softwareishard.com/blog/har-12-spec/"
    },
    "binarySignature": {
      "endianness": "text",
      "magicBytes": [],
      "containerFamily": "text",
      "headerLayout": [
        {
          "offset": "0x00+",
          "byteOffset": 0,
          "byteLength": 32,
          "lengthLabel": "var",
          "dataType": "utf8_json",
          "fieldName": "log_root",
          "description": "JSON object with root `log.version` ('1.2') and `log.entries[]`"
        }
      ]
    },
    "securityProfile": {
      "riskLevel": "high",
      "allowsArbitraryCodeOrMacros": false,
      "xxeRisk": false,
      "polyglotPrependRisk": false,
      "pickleDeserializationRisk": false,
      "uploadValidationNotes": "Never upload raw .har files to third-party cloud viewers. Strip Authorization, Cookie, Set-Cookie, X-API-Key, and query tokens locally (e.g. via /tools/har-sanitizer)."
    },
    "codeSnippets": {
      "python": "import json, sys\nwith open(sys.argv[1], \"r\", encoding=\"utf-8\") as f:\n    log = json.load(f)[\"log\"]\n    print(f\"HAR v{log.get('version')}: {len(log.get('entries', []))} entries\")",
      "typescript": "export async function summarizeHar(file: File) {\n  const doc = JSON.parse(await file.text());\n  return { version: doc.log?.version, entries: doc.log?.entries?.length ?? 0 };\n}",
      "rust": "use std::fs;\nfn main() -> std::io::Result<()> {\n    let s = fs::read_to_string(std::env::args().nth(1).expect(\"usage: <prog> <file>\"))?;\n    println!(\"HAR size={}B has_entries={}\", s.len(), s.contains(\"\\\"entries\\\"\"));\n    Ok(())\n}",
      "go": "package main\nimport (\"encoding/json\"; \"fmt\"; \"os\")\nfunc main() {\n    b, err := os.ReadFile(os.Args[1])\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"read:\", err)\n        os.Exit(1)\n    }\n    var m map[string]any\n    if err := json.Unmarshal(b, &m); err != nil {\n        fmt.Fprintln(os.Stderr, \"invalid JSON:\", err)\n        os.Exit(1)\n    }\n    fmt.Println(\"HAR root keys:\", len(m))\n}"
    },
    "relatedFormats": [
      "pcap",
      "jsonl",
      "csv"
    ],
    "verifiedAt": "2026-11-14T16:09:03Z"
  },
  "samples": [
    {
      "id": "har-minimal",
      "filename": "minimal.har",
      "variant": "minimal",
      "title": "Minimal Clean HTTP/2 HAR 1.2 Capture",
      "description": "Sanitized single-entry HAR 1.2 JSON capture with timing metrics and zero sensitive headers.",
      "localPath": "/fixtures/v1/har/minimal.har",
      "cdnUrl": "https://fileformat.co/fixtures/v1/har/minimal.har",
      "sizeBytes": 1642,
      "sha256": "be133a81b716a13a5d522aadc458e221ba61a151794f62ca0747f8457040a3ec",
      "expectValid": true
    },
    {
      "id": "har-realistic",
      "filename": "api-trace.har",
      "variant": "realistic",
      "title": "5-Entry REST API Waterfall HAR Trace",
      "description": "Multi-entry HAR 1.2 waterfall: session GET, inference POST with postData.params, job poll, metrics GET, cache DELETE — distinct bytes from minimal.har.",
      "localPath": "/fixtures/v1/har/api-trace.har",
      "cdnUrl": "https://fileformat.co/fixtures/v1/har/api-trace.har",
      "sizeBytes": 7212,
      "sha256": "cc221c9784a6a58ffc8b3a3a15659372cc8d7bfb1fe530b3ff5983a9f681c972",
      "expectValid": true
    },
    {
      "id": "har-edge-case",
      "filename": "edge-case-auth-leak.har",
      "variant": "edge-case",
      "title": "HAR with Benign Canary Bearer Token, Cookie, Query & Response Secrets",
      "description": "Designed to test HAR credential scrubbers: inert BENIGN_CANARY tokens in headers, cookies, query params AND the JSON response body (access_token/refresh_token).",
      "localPath": "/fixtures/v1/har/edge-case-auth-leak.har",
      "cdnUrl": "https://fileformat.co/fixtures/v1/har/edge-case-auth-leak.har",
      "sizeBytes": 2170,
      "sha256": "d39ab47406fe2557509be31ef0eff1c5d38ad506abcfa2043c3bca836931c290",
      "expectValid": true,
      "edgeCaseTag": "Canary Auth & Cookie Leak"
    }
  ]
}