When diagnosing website performance bottlenecks, broken API authentication tokens, slow asset loading, or third-party script failures, taking screenshots or copying error messages is rarely sufficient for web developers and IT support teams. What engineers require is a complete, chronologically recorded snapshot of every HTTP and HTTPS transaction sent and received during a browsing session. This standardized JSON formatted record is called a HAR (HTTP Archive) file. In macOS, Apple’s native browser includes a built-in HAR recording and export engine inside the Safari Web Inspector.
What a HAR File Captures in Safari
An exported HAR file encapsulates all low-level telemetry recorded across your browser’s network waterfall:
- Request & Response Headers: Full details of request methods (GET, POST), status codes (200, 404, 500), cookies, authorization bearers, and caching directives.
- Timing Waterfall Breakdown: Millisecond-accurate measurements for DNS lookup, initial TCP connection, TLS/SSL handshake negotiation, Time to First Byte (TTFB), and content download phases.
- Payload Data: Captured POST body strings, query parameters, API responses, and resource byte sizes.
- Security Protocol Metadata: Negotiated TLS versions, cipher suites, and server certificate verification results.
Enabling the Develop Menu in Safari on Mac
Because Web Inspector is a developer tool, ensure Safari’s Develop menu is visible in your Mac’s top menu bar:
- Open Safari on your Mac.
- Click Safari in the menu bar and select Settings… (or press Cmd + ,).
- In the Settings window, switch to the Advanced tab.
- At the bottom of the pane, tick the checkbox next to Show features for web developers (or Show Develop menu in menu bar on older macOS versions).
- Close the Settings window. A new Develop menu will now appear in your menu bar.
Capturing and Exporting a HAR File
To record and export clean network telemetry for troubleshooting:
- Navigate to the web page where you are experiencing issues.
- Open Web Inspector by pressing Cmd + Option + I (or right-click anywhere on the webpage and select Inspect Element).
- In the Web Inspector toolbar at the top of the pane, click the Network tab.
- Tick the Preserve Log checkbox in the Network toolbar. This ensures previous network requests are not erased if the page performs an automatic reload or redirects across multiple URLs.
- Reload the webpage (Cmd + R) or perform the specific user action (e.g. clicking a submit button or completing a checkout) that triggers the issue.
- Allow all network assets and API calls to finish loading in the waterfall table.
- Click the Export button in the upper-right corner of the Network tab (depicted as a downward arrow into a tray, or right-click any network row and select Export HAR).
- Choose a save destination (such as your Desktop), name your file (e.g.
safari_network_trace.har), and click Save.
Inspecting and Reviewing Exported HAR Files
Once exported, you can analyze the file or share it with support teams:
| Inspection Method | Tool / Utility | Analysis Capability |
|---|---|---|
| Safari Web Inspector Import | Drag and drop .har file into empty Network tab |
Re-renders the original interactive timeline, waterfall bars, and header inspection panes inside Safari. |
| Online HAR Viewers | Google Admin Toolbox HAR Analyzer | Highlights slow TTFB, DNS resolution bottlenecks, and HTTP error codes automatically. |
| Text Editor / JSON Tool | VS Code / jq |
Enables programmatic querying of headers, response payloads, and status codes. |
Sanitising Sensitive Authentication Tokens
Because HAR files capture raw HTTP headers and request bodies, they may contain active session cookies, API secret keys, or passwords:
- Never Share Unsanitised HAR Files Publicly: Open the file in a text editor like BBEdit or VS Code and search for authorization headers (e.g.
Bearer eyJhb...) or session cookies before sending files to third-party vendors. - Log Out After Capture: If you must submit a HAR capture to external support, immediately log out of your session on the target website after saving the file. Logging out invalidates active session tokens, preventing unauthorized reuse.