.har Tier 1 · Deep AST Parser

HTTP Archive v1.2 Capture

UTF-8 JSON network session capture exported by Chrome/Firefox/Playwright containing full HTTP headers, cookies, request payloads, and timing waterfalls.

High-risk credential leak vector! Raw DevTools `.har` exports record live `Authorization: Bearer`, `Cookie`, `Set-Cookie`, and OAuth tokens in cleartext.

MIME Types application/json

Byte Endianness text

Container Family text

Canonical Spec Official Specification ↗

0xFF

Drop any .har file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.har Magic Bytes & Header Offset Map

Note: HAR does not rely on a fixed static magic byte sequence at offset 0x00; parsers validate structural framing defined below.

Byte Offset	Length	Data Type	Field Name	Engineering Description
0x00+	var	utf8_json	log_root	JSON object with root `log.version` ('1.2') and `log.entries[]`

Upload Gateway & AppSec Advisory

.har Security & Polyglot Risk Matrix

Risk Level: high

Arbitrary Code / Macros

NO (Inert Data)

Pickle Deserialization

SAFE (No Pickle VM)

XML External Entity (XXE)

NONE

Polyglot Prepend Risk

LOW (Strict 0x00 Magic)

Backend Upload Validation Recommendation

Never upload raw .har files to third-party cloud viewers. Strip Authorization, Cookie, Set-Cookie, X-API-Key, and query tokens locally (e.g. via /tools/har-sanitizer).

Compiler-Verified Reference Code

Read .har Header & Metadata Without Heavy Dependencies

✓ Zero-Dependency .har Header Reader

import json, sys
with open(sys.argv[1], "r", encoding="utf-8") as f:
    log = json.load(f)["log"]
    print(f"HAR v{log.get('version')}: {len(log.get('entries', []))} entries")

CI/CD & Unit Test Fixtures

Deterministic .har Sample Files & Edge Cases

Open Full .har Sample Matrix & Mutator →

minimalexpect: valid

minimal.har

Sanitized single-entry HAR 1.2 JSON capture with timing metrics and zero sensitive headers.

↓ Download (1.6 KB)

SHA-256: be133a81b716a13a5d522aadc458e221ba61a151794f62ca0747f8457040a3ec

Exact: 1,642 bytes

curl -fsSL https://fileformat.co/fixtures/v1/har/minimal.har -o minimal.har \
  && echo "be133a81b716a13a5d522aadc458e221ba61a151794f62ca0747f8457040a3ec  minimal.har" | shasum -a 256 -c

realisticexpect: valid

api-trace.har

Multi-entry HAR 1.2 waterfall: session GET, inference POST with postData.params, job poll, metrics GET, cache DELETE — distinct bytes from minimal.har.

↓ Download (7.0 KB)

SHA-256: cc221c9784a6a58ffc8b3a3a15659372cc8d7bfb1fe530b3ff5983a9f681c972

Exact: 7,212 bytes

curl -fsSL https://fileformat.co/fixtures/v1/har/api-trace.har -o api-trace.har \
  && echo "cc221c9784a6a58ffc8b3a3a15659372cc8d7bfb1fe530b3ff5983a9f681c972  api-trace.har" | shasum -a 256 -c

edge-caseCanary Auth & Cookie Leakexpect: valid

edge-case-auth-leak.har

Designed to test HAR credential scrubbers: inert BENIGN_CANARY tokens in headers, cookies, query params AND the JSON response body (access_token/refresh_token).

↓ Download (2.1 KB)

SHA-256: d39ab47406fe2557509be31ef0eff1c5d38ad506abcfa2043c3bca836931c290

Exact: 2,170 bytes

curl -fsSL https://fileformat.co/fixtures/v1/har/edge-case-auth-leak.har -o edge-case-auth-leak.har \
  && echo "d39ab47406fe2557509be31ef0eff1c5d38ad506abcfa2043c3bca836931c290  edge-case-auth-leak.har" | shasum -a 256 -c

Related Specifications & Alternatives

.pcap mixed

PCAP

Classic 24-byte header packet capture format produced by `tcpdump` and Wireshark, encoding host endianness and timestamp precision directly in its 4-byte magic number.

.jsonl text

JSONL

Streaming line-oriented text format where every newline-separated record is a standalone UTF-8 JSON value—standard for LLM fine-tuning (SFT/DPO) datasets and batch APIs.

.csv text

CSV

Plain-text tabular interchange format notorious for real-world parser edge cases: optional UTF-8 BOMs (`EF BB BF`), multiline quoted cells, doubled quote escapes (`""`), and formula injection.