Master Fiddler HAR Export and Web Performance Analysis

Why HAR Export Matters for Real-World Performance Debugging

Modern web applications generate dozens — sometimes hundreds — of HTTP(S) requests per page load. Without structured, portable insight into timing, headers, cookies, and resource sizes, diagnosing slow page loads, third-party bottlenecks, or caching misconfigurations becomes guesswork. The HTTP Archive (HAR) format solves this: it’s a JSON-based standard for recording browser network activity, supported by Lighthouse, WebPageTest, Chrome DevTools, and yes — Fiddler. When you export a HAR from Fiddler, you’re capturing not just raw traffic, but contextual performance metadata — DNS lookup time, SSL negotiation duration, request queuing, and content download breakdowns. That makes HAR export a cornerstone of professional fiddler debugging, especially in performance analysis.

Fiddler’s HAR export goes beyond passive logging. It integrates with Fiddler’s powerful https decryption, full request/response inspection, and filtering capabilities — meaning you can capture only the traffic that matters, scrub sensitive data before sharing, and correlate timing anomalies with specific headers or server responses. Whether you're optimizing Core Web Vitals, auditing CDNs, or validating API response compression, mastering HAR export transforms Fiddler from a simple fiddler proxy into a precision performance observability tool.

Prerequisites: Getting Fiddler Ready for Reliable HAR Capture

Before exporting, ensure your Fiddler instance is configured for accurate, complete, and secure capture:

Enable HTTPS Decryption

Without https decryption, Fiddler sees only TLS handshakes — no request bodies, headers, or response content. To enable:

Go to Tools > Options > HTTPS
Check Decrypt HTTPS traffic
Click Actions > Trust Root Certificate and follow Windows certificate trust prompts
Confirm Ignore server certificate errors is unchecked unless testing self-signed dev environments

⚠️ Troubleshooting tip: If HTTPS traffic appears as Tunnel to domain.com:443, decryption failed. Verify the Fiddler root cert is installed in Trusted Root Certification Authorities, not just Personal. Run certmgr.msc to check.

Configure Capture Scope & Filters

Avoid bloated, noisy HAR files by narrowing scope before recording:

Use the Filters tab to uncheck Capture HTTPS CONNECTs (unless debugging tunneling)
Set Hide if URL contains to filter out known telemetry (e.g., analytics.js, segment.io, hotjar.com) — this keeps your HAR focused on core app assets
Toggle Capture from all processes off if debugging a specific app (e.g., only Chrome or Electron)

Set Up Auto-Save (Optional but Recommended)

For repeatable testing, configure auto-save to avoid manual exports:

Rules > Customize Rules → open CustomRules.js

Add this inside OnBeforeRequest:

if (oSession.fullUrl.Contains("/my-app/")) {
    oSession.SaveSessionToHAR();
}

Save and restart Fiddler. Sessions matching the condition auto-export to %USERPROFILE%\Documents\Fiddler2\HAR\

Step-by-Step: Exporting a Clean, Shareable HAR File

Step 1: Start Capture and Reproduce the Scenario

Launch Fiddler, confirm the Capture Traffic button (●) is red, then perform the exact user flow you want analyzed — e.g., login → dashboard load → click chart → export CSV. Avoid background tabs or extensions that poll APIs (e.g., password managers, ad blockers).

Step 2: Filter and Sanitize Before Export

Select relevant sessions in the Web Sessions list (Ctrl+click or Shift+click). Right-click → Remove Unselected to prune noise. Then:

Edit > Remove Request Headers → clear Authorization, Cookie, X-Api-Key (critical for security before sharing)
File > Export Sessions > All Sessions > HTTPArchive (HAR)
In the export dialog:
- ✅ Include request bodies (for POST payload analysis)
- ✅ Include response bodies (to inspect HTML, JSON, image encodings)
- ❌ Include binary content (uncheck unless debugging image corruption — increases file size 10x)
- ✅ Strip credentials from URLs (removes ?token=abc123 automatically)

Step 3: Name Strategically and Verify

Save as dashboard-load-2024-06-15.har. Open the .har file in VS Code or a JSON validator. Confirm:

log.entries.length > 0
Each entry has startedDateTime, time, request.url, and response.status
log.pages exists (if using Fiddler’s Page Inspector or custom page markers)

💡 Pro tip: Use Fiddler’s Timeline view (View > Timeline) before export to visually spot long-running requests — then right-click those sessions and Export Selected Only.

Analyzing Your HAR: Beyond Opening in Chrome DevTools

A HAR file isn’t just for import — it’s rich data you can query, compare, and automate.

Quick Visual Analysis in Browser DevTools

Open Chrome DevTools (F12) → Network tab
Right-click anywhere in the Network panel → Import HAR…
Drag in your .har file

You’ll see waterfall charts, resource sizes, cache status, and initiator chains — identical to live capture, but replayable and shareable. Look for:

Red Status codes (4xx/5xx) indicating failed API calls
Yellow Size column showing uncompressed vs. encoded size (reveals missing Content-Encoding: gzip)
Waterfall gaps >100ms between DNS Lookup, Connecting, SSL, Sending, Waiting, Receiving

Quantitative Analysis with HAR Analyzer Tools

For metrics that matter to real users:

webpagetest.org → paste HAR to get TTFB, First Contentful Paint, Speed Index
HAR Analyzer → shows top 10 slowest resources, largest responses, and cookie bloat
Local CLI: npm install -g har-stats → run har-stats my.har for median TTFB, total transfer size, image bytes %

Custom Analysis with Python (Example)

Need to audit all fetch() calls lacking cache: 'force-cache'?

import json
with open('dashboard-load.har') as f:
    har = json.load(f)

for entry in har['log']['entries']:
    url = entry['request']['url']
    if 'api/' in url and entry['request']['method'] == 'GET':
        headers = {h['name'].lower(): h['value'] for h in entry['request']['headers']}
        if 'cache-control' not in headers:
            print(f'⚠️  Missing cache-control: {url}')

This kind of targeted http debugging reveals patterns no UI can.

Advanced: Correlating HAR Data with Fiddler’s Built-in Metrics

Fiddler doesn’t just export HAR — it enriches it with its own timing precision. Compare these two values in your exported HAR:

entry.timings.waiting ≈ Fiddler’s ServerGotRequest timestamp minus ClientDoneRequest
entry.timings.receiving ≈ ServerDoneResponse minus ServerGotRequest

When waiting is high (>500ms), check Fiddler’s Inspector > TextView for X-Response-Time or X-Backend-Time headers. When receiving dominates, use Inspectors > ImageView to verify JPEG quality/compression ratio — then cross-reference with Content-Length in the HAR.

Also leverage Fiddler’s Statistics tab before export: it computes real-time metrics like:

Total requests, unique hosts, MIME type distribution
Aggregate download time, bandwidth used, average latency
Breakdown of HTTP/1.1 vs HTTP/2 vs QUIC usage

These numbers contextualize your HAR — e.g., “87% of images are JPEG, but only 32% use progressive encoding” tells you where to optimize next.

Troubleshooting Common HAR Export Issues

Symptom	Likely Cause	Fix
HAR file is empty (`"entries":[]`)	Capture was paused, or filters excluded all traffic	Check status bar: should say “Capturing: Yes”. Verify Filters > Use Filters is unchecked or rules allow your domain.
`response.content.text` is null or truncated	Response body wasn’t captured due to size limits or streaming	In Tools > Options > General, increase Maximum buffer size (KB) to 10000. Disable Stream responses for large JSON/API payloads.
`startedDateTime` shows wrong timezone	Fiddler uses local system time, but HAR spec expects UTC	Ignore — browsers and analyzers auto-convert. Validate timestamps align with Fiddler’s `#` column (elapsed ms since start).
Sensitive tokens appear in HAR despite sanitization	`Edit > Remove Request Headers` doesn’t scrub URL query params or response bodies	Manually edit HAR JSON pre-share, or use FiddlerScript: `oSession.utilReplaceInResponse("token=[^&]+", "token=REDACTED")`.

Conclusion: Turn HAR Export Into Your Performance Feedback Loop

HAR export in Fiddler isn’t a one-off task — it’s the bridge between raw fiddler proxy traffic and actionable, stakeholder-ready performance insights. When you combine precise https decryption, intelligent filtering, header sanitization, and post-export analysis, you shift from reactive fire-drills to proactive optimization. Every exported HAR is a timestamped, auditable snapshot of how your application actually performs under real conditions — not ideal lab scenarios.

Key takeaways:

Always enable https decryption and validate certificate trust before recording critical flows
Filter early, sanitize deliberately, and name HARs with context (e.g., checkout-failure-mobile.har)
Use both browser-based HAR import and CLI tools like har-stats for complementary views
Cross-reference HAR timings with Fiddler’s Statistics tab and Inspector views for root-cause depth
Automate HAR export for CI/CD performance regression checks using FiddlerCore or FiddlerScript

Ready to level up your workflow? more tutorials cover advanced scripting, automated API contract validation, and integrating Fiddler with Selenium. For deeper dives into metrics that impact real users, browse Performance Analysis tutorials. Have questions about enterprise deployment or custom HAR enrichment? contact us — we help teams ship faster, safer, and more performant web apps.