How to Capture a HAR File for Bugs

A HAR file is a JSON record of requests captured by a browser. To make one for a bug report in desktop Chrome, open DevTools Network before the failure, record a short attempt, then export HAR (sanitized). Review the file before sharing it: Chrome's sanitized export removes selected sensitive headers, but it can still contain private URLs, paths, query values, or request and response bodies. Chrome documents the recording and HAR export controls.

1. Open the affected page and its DevTools Network panel before repeating the action. Check that recording is on, then clear earlier requests. Keep the capture window to the setup and one attempt you need to explain.
2. Use Preserve log only if the failure crosses a navigation or reload. Otherwise leave it off so old page loads do not crowd the trace. Check any active filters: a filtered export can omit requests you meant to include.
3. Perform the action once and note the visible result. Stop recording after the relevant requests finish. Export with the action-bar Export HAR (sanitized) control, or right-click a request and choose Copy → Save all [listed] as HAR (sanitized). Labels may vary by Chrome version; use the sanitized option shown in the current Network reference.

For the fictional checkout, start recording just before pressing Place order and stop once the visible outcome and related requests settle. If submitting navigates to another page, repeat with Preserve log enabled; Chrome’s Network reference documents that setting and HAR export. Keep the first short capture if it contains the failure. A second attempt may produce a different result, so label attempts separately instead of combining them into one claimed sequence.

If the exported file has no POST /api/orders, check recording, filters, and whether the action actually submitted. Report “request not recorded” when that is all the evidence supports. Do not fill the gap by assigning a server status.

Chrome says its default sanitized HAR excludes Cookie, Set-Cookie, and Authorization headers. That is a narrow browser export rule, not a guarantee that the whole file is private-data-free. Inspect retained hostnames, paths, query strings, headers, form fields, and bodies for account identifiers, tokens, names, or client content. Choose a smaller capture window if the file includes unrelated activity.

Use the HAR sanitizer to remove additional fields locally, then inspect what remains, including paths and timestamps. The HAR analyzer accepts a file up to 20 MiB and 10,000 entries; those are this tool's limits, not Chrome's capture limits. If a long trace exceeds them, record a shorter relevant attempt instead of arbitrarily editing HAR JSON.

• Confirm the Network panel was open on the affected tab before the action and recording was on. Clear search and type filters to inspect the full request list before exporting.
• If navigation erased the earlier request, enable Preserve log and try the same short sequence again. If the action produced no network request, report that observation; a HAR cannot supply a request that was never recorded.
• Keep cache and throttling settings consistent between comparisons, and record them when known. A different setting can change which requests appear.

A useful handoff pairs the reviewed HAR with the action, starting state, expected and actual results, browser/version, tested release, and attempt count. The reproduction guide helps write that sequence; the console guide covers a separate kind of evidence. Add the reviewed observation to the bug-report generator or compare it with the sample report. Capturing a HAR does not replay requests or diagnose the bug.

Published October 9, 2026. Updated October 10, 2026. Method: the browser controls and sanitized-header behavior follow Chrome's linked Network reference; the checkout trace is fictional.