HAR Forensics & Network Performance Studio
100% client-side network forensics and performance analyzer with zero uploads. Inspect HAR 1.2 files, visualize waterfall timings, diagnose slow requests, audit security headers (CSP, HSTS, CORS), detect sensitive tokens, sanitize/redact private data, and compare HAR archives.
- 100% client-side inspection: Zero uploads, zero persistent storage (runs in session memory only)
- HAR 1.2 standard compliance: Preserves log, creator, browser, pages, entries, timings, cookies, and vendor extensions
- Interactive waterfall timeline: Decomposes blocked, DNS, connect, SSL, send, wait, and receive phases with accessible table view
- Performance forensics: Detects slow requests (>1000ms), large payloads (>500KB), redirect chains, duplicate candidates, and bursts
- Security header matrix: Audits CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, CORS, and cookie attributes
- Privacy detection & Redaction Studio: Identifies Authorization, cookies, URL tokens, JWTs, and masks them safely into Sanitized HAR
- HAR diff comparison & command generator: Side-by-side neutral metric deltas, safe cURL/Fetch generation, and PDF/CSV/Markdown export
Drag & drop a .har or JSON file here
Drop file to begin forensic analysis
About HAR Forensics & Network Performance Studio
Solasu HAR Forensics & Network Performance Studio is a comprehensive client-side workspace designed to do far more than merely display HTTP Archive files. It enables web developers, security analysts, and system administrators to validate archive integrity, diagnose latency bottlenecks, audit security headers, identify confidential tokens, sanitize credentials for share-safe distribution, and perform side-by-side comparative diffs—all within a single secure interface.
All processing executes entirely inside your web browser. No HAR bytes, URLs, headers, payloads, or cryptographic digests are ever transmitted to external servers or persisted in browser databases.
HAR 1.2 Structural Integrity & Interactive Waterfall Analysis
Load HAR 1.2 archives exported from Google Chrome, Mozilla Firefox, Microsoft Edge, or Safari with instant drag-and-drop convenience. The studio faithfully inspects standard log objects, creator tools, page metadata, connection details, and vendor extensions.
The interactive Waterfall chart decomposes connection lifecycles into 7 distinct phases: blocked, DNS resolution, TCP connection, SSL/TLS handshake, send, wait (Time to First Byte / TTFB), and receive. In addition, an accessible table view ensures compliance with accessibility standards while concurrency and burst monitors highlight peak connection pressure.
Objective Performance Forensics & Security Audit
In strict adherence to objective forensic standards, the studio rejects arbitrary 100-point scores or competitive rankings. Instead, it surfaces clear empirical observations: slow requests (>1000ms), large payloads (>500KB), HTTP 4xx/5xx failures, redirect chains, and duplicate request candidates.
A dedicated security header matrix evaluates Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, CORS, and cookie flags (Secure, HttpOnly, SameSite). Every finding is accompanied by underlying evidence, evaluation methodology, and forensic boundaries.
Privacy Redaction Studio & Neutral A/B Comparison
Before sharing an archive with third-party vendors or public issue trackers, use the built-in Redaction Studio to automatically detect and mask sensitive Authorization headers, session cookies, credential-bearing URL query parameters, JWT tokens, IP addresses, and email addresses. The sanitized archive is validated and exported as clean JSON while the original HAR remains untouched in session memory.
Load up to two archives (HAR A vs HAR B) to perform side-by-side diff analysis. Review objective metric deltas for request counts, data volumes, average durations, and individual endpoint changes without biased winning classifications.
Frequently Asked Questions About HAR Forensics & Network Analysis
What is a HAR (HTTP Archive) file?
A HAR (HTTP Archive) file is a standardized JSON-formatted record of web browser network activity. It logs details of every HTTP/HTTPS transaction during page load, including requested URLs, status codes, request/response headers, query parameters, cookies, timing breakdowns, and optional payload bodies.
What is the HAR 1.2 specification?
HAR 1.2 is the official specification drafted by the W3C Web Performance Working Group. It defines the structured schema rooted at 'log', containing creator, browser, pages, entries, timings, request, response, and cookie objects.
How do I export a HAR file from Google Chrome?
Open Chrome DevTools (press F12 or right-click and choose Inspect). Navigate to the 'Network' tab, reload your page to record network activity, and click the down-arrow icon labeled 'Export HAR' located in the network toolbar.
How do I export a HAR file from Mozilla Firefox?
Open Firefox Developer Tools (F12), switch to the 'Network' tab, and reload the target page. Once traffic is captured, click the gear icon in the top-right of the network list and select 'Save All As HAR'.
Do HAR files contain session cookies and passwords?
Yes. Standard HAR files record raw Cookie and Set-Cookie headers, authorization tokens, and form post data. Sharing an unredacted HAR file publicly may expose active session tokens or credentials. Use Solasu's Redaction Studio to sanitize sensitive data before sharing.
Do HAR files capture Authorization headers and Bearer tokens?
Yes. Web API calls including Authorization headers (such as OAuth Bearer tokens, basic auth strings, or API keys) are recorded in plain text. Solasu HAR Studio automatically flags these headers and replaces their values with [REDACTED].
Is my HAR file uploaded to any remote server?
No. Solasu HAR Forensics Studio runs 100% inside your browser using client-side JavaScript and WebAssembly. No archive bytes, URLs, headers, or body strings are ever sent to an external server or saved into persistent browser storage.
What is a network waterfall diagram?
A waterfall diagram is a chronological visualization of web requests. It charts each HTTP request on a horizontal time axis, illustrating when each request started and how long it spent in each phase (DNS lookup, TCP connection, SSL handshake, initial wait, and download).
What does the 'blocked' timing phase represent?
The blocked phase measures the time a request spent waiting in browser queues before transmission could begin. Common causes include socket pool saturation (browser connection limits per domain) or proxy negotiation.
What does the 'DNS' timing phase represent?
DNS lookup time measures the duration required to resolve a domain name into an IP address. If the host address is already cached by the operating system or browser, this value is 0 or unavailable (-1).
What do 'connect' and 'SSL' timing phases represent?
The 'connect' phase reflects the duration of the TCP three-way handshake. For HTTPS connections, the SSL/TLS cryptographic handshake duration is captured under the 'ssl' field as part of the overall connection establishment.
What does 'wait' (TTFB) represent and why must it be interpreted carefully?
Wait (Time to First Byte) measures the duration from when the browser finished sending the request until it received the first byte of response data. Crucially, this is a client-observed network round-trip measurement and cannot be asserted as pure server compute time.
What does the 'receive' timing phase represent?
The receive phase spans the arrival of the first byte of response data until the entire response body is downloaded. It is governed by content size and available network throughput.
How are HTTP 4xx and 5xx errors handled?
Requests returning 4xx (client errors like 404 Not Found or 401 Unauthorized) and 5xx (server errors like 500 Internal Server Error) are automatically classified under failure filters for immediate forensic isolation.
What is CORS (Cross-Origin Resource Sharing)?
CORS is a browser security mechanism that regulates cross-domain resource sharing. Solasu inspects Access-Control response headers and notes wildcard (*) or permissive credential configurations objectively without issuing legal warranties.
What does the Content-Security-Policy (CSP) audit inspect?
CSP mitigates cross-site scripting (XSS) and injection attacks. Solasu parses CSP directives and flags noteworthy keywords such as 'unsafe-inline', 'unsafe-eval', or wildcard origins for reviewer awareness.
What is HSTS (HTTP Strict Transport Security)?
HSTS instructs browsers to communicate with a domain exclusively over HTTPS. Solasu checks the presence of max-age, includeSubDomains, and preload directives to assess secure transport enforcement.
What are Secure, HttpOnly, and SameSite cookie attributes?
The Secure attribute restricts cookie transmission to encrypted HTTPS connections. HttpOnly blocks JavaScript access (document.cookie) to mitigate XSS cookie theft. SameSite controls cross-site transmission behavior (Strict, Lax, or None).
How are first-party and third-party resources distinguished?
The studio inspects the root page domain and compares resource hostnames. Domains sharing the same apex registrable domain are considered first-party, while external CDN, widget, or tracker domains are flagged as third-party.
What is HAR Redaction and sanitization?
HAR Redaction is the process of stripping sensitive credentials—such as session cookies, bearer tokens, API keys, and email addresses—from a HAR file and replacing them with placeholder tokens while preserving valid HAR 1.2 structure.
Is a Sanitized HAR completely safe to share publicly?
Automated sanitization removes common tokens, headers, and patterns, but automated heuristic scanners cannot guarantee 100% removal of unique proprietary secrets. Users must inspect the output before external dispatch.
What are the safe cURL and Fetch generator features?
The studio converts captured HAR requests into executable cURL commands, JavaScript fetch calls, and Python requests snippets. If credentials exist, warning notices are displayed, and an option to generate a sanitized version is provided.
How does HAR comparison (A/B Compare) work?
Users can load two separate HAR archives to compare request count deltas, byte sizes, timing differences, and added/removed endpoints in a side-by-side neutral diff view without biased scores.
Why do some HAR entries omit response bodies?
Browser export settings frequently disable body recording for performance or size reasons. Solasu explicitly distinguishes between network communication errors and bodies omitted from the archive file.
What is a JWT-like token observation?
When three-segment Base64URL strings matching JSON Web Tokens are found, Solasu decodes the header and payload for inspection. The studio explicitly notes that cryptographic signatures are not verified.
Can this tool replay requests or fetch live URLs?
No. To maintain complete user privacy and eliminate security risks, live request replay, proxy forwarding, and remote crawler calls are intentionally prohibited.
Is this tool an antivirus or malware scanner?
No. Solasu HAR Studio is an architectural and forensic inspector for network logs, not an antivirus engine. It does not scan binaries for malware signatures or exploit payloads.