HAR Viewer & HAR File Analyzer (HTTP Archive)

HAR Viewer & HAR File Analyzer (HTTP Archive), a VS Code extension by Zovo

Open a .har file from browser DevTools in VS Code and see every request in a table with a timing waterfall, then copy any call as cURL or save a redacted copy that is safe to share.

Free, MIT license. Needs VS Code 1.90.0 or newer. Extension ID zovo.zovo-har-viewer, version 0.1.1.

The screenshot is a real VS Code 1.142 window running this extension on shop-checkout.har, a sample made by scripts/make-samples.js with fake hosts and fake tokens.

• See where the time went. Each row has a waterfall bar split into DNS, connect, TLS, waiting and download, and the summary counts failed and slow requests so you can jump straight to them.
• Read the whole exchange. Request and response headers, query string, payload, cookies and the response body, with JSON pretty-printed, form fields as a table and images shown inline.
• Share without leaking a session. A banner warns when the file holds Authorization headers, cookies or tokens, and one click writes a copy with those values replaced by [REDACTED].

Quick start

1. In Chrome, Edge or Firefox open DevTools, go to the Network tab and choose "Save all as HAR" (Safari calls it "Export HAR").
2. Click the .har file in the VS Code Explorer. It opens in HAR Viewer.

Questions people ask

What you can do

What the redacted copy changes

• Authorization, Proxy-Authorization, API key, CSRF and similar headers become [REDACTED]. The Bearer or Basic word stays so you can still see the scheme.
• Cookie and Set-Cookie headers keep the cookie names and attributes, with each value replaced. The cookie lists in the HAR get the same treatment.
• Query, form and JSON fields with names such as access_token, refresh_token, password, client_secret, api_key or session_id, and any JWT, are replaced in URLs, request bodies and text response bodies.
• The original file is never changed, and a save over it is refused. A clean copy opens without the warning.

The rules are name-based. A secret stored under an unusual field name, or inside a binary body, is not found, so read the copy before you send it.

Large files

A HAR is one JSON document, so it is read whole. In the release test a 47 MB capture with 30,000 requests showed its first rows in 0.8 seconds and all rows in under 1 second, a status filter over all 30,000 took about 0.2 seconds, and the rest of VS Code never waited more than 30 ms. Only the visible rows are drawn, so scrolling stays smooth. Files above harViewer.maxFileMB (300 MB by default) show a message instead of loading. Bodies longer than harViewer.maxBodyKB are cut in the details pane, and Copy still copies the full text.

Settings

Privacy

HAR Viewer works offline. It makes no network calls and sends no telemetry. The webview runs under a strict Content Security Policy with no remote scripts, images in a HAR are shown from the file itself, and every value from the file is shown as text, never as HTML.

Known limits

• The viewer is read-only. Edit the JSON with "Open as text" if you need to.
• WebSocket frames (_webSocketMessages) are not listed yet. The upgrade request shows as a WS row.
• Pages are not grouped. The summary uses the timings of the first page in the file.
• Redaction is pattern-based, as described above.

License

MIT

Guides

• Read a HAR file offline in VS Code