1. Home
  2. Tools
  3. HAR Compare

Compare Two HAR Files: Working vs Broken

Drop a HAR from when it works and one from when it doesn't. See both captures side by side, every difference lined up, and our thoughts on what to check first. Both files stay in your browser.

Both files are processed locally. Nothing is uploaded.

How to compare two HAR files

  1. Capture a working HAR. Open DevTools (F12) → Network, tick Preserve log, do the steps while they work, then right-click → Save all as HAR with content.
  2. Capture a broken HAR of the same steps where it fails: another user, another network, with the VPN or proxy on, or a different browser.
  3. Drop both files above. Working on the left, broken on the right.
  4. Start where the flows split. Then open rows to compare headers, cookies, timings and response bodies side by side.

What the comparison checks

  • Missing and extra requests: where the broken flow stopped or took a different path.
  • Status changes: 200 → 403 block pages, 401 auth failures, 407 proxy authentication, 5xx server errors and requests that never got a response.
  • Redirects: SSO redirect loops and redirects to a different identity provider or login page.
  • Cookies: cookies set in one capture but missing in the other, or received but never sent back (SameSite and third-party cookie problems).
  • Network path: traffic going through an explicit proxy or Zscaler addresses in only one capture, and HTTP/2 falling back to HTTP/1.1.
  • Speed: which phase got slower, whether DNS, connect, TLS, server wait or download.
  • Content: an API returning an HTML page instead of JSON, and missing CORS headers.

Working with a single file? Use the HAR Analyzer. For Zscaler and Palo Alto cases, see HAR file analysis for Zscaler and Palo Alto, and sanitize files before sharing them.

Frequently asked questions

How do I compare two HAR files?

Capture one HAR while things work and one while they fail, ideally the same steps on the same page. Drop the working file on the left and the broken file on the right. The tool lines up matching requests, highlights what changed and lists what to check first.

Are my HAR files uploaded?

No. Both files are read and compared by JavaScript in your browser tab. Nothing is sent to HardcoreDebug, and closing the tab discards them.

How are requests matched between the two files?

By method, host and path, ignoring parts that always change between captures, such as IDs, hashes, tokens and query values. The first matching request in each file is paired, then the second, and so on. Requests with no partner are shown as missing or only-in-broken.

What does 'the flows split at row N' mean?

It's the first request where the two captures behave differently: a request that failed, changed status or never happened. Problems usually start there; later differences are often knock-on effects.

Can it tell me the root cause?

No tool can be sure. It's just a comparison: it shows what's different and suggests what to check. Use your own judgement to review it, because it can't see your firewall policy, identity provider settings or server logs.

Does it work for Zscaler, Palo Alto or SSO problems?

Yes, that's what it's built for. It flags block pages and 403s, proxy authentication (407), redirect loops, cookies that are set but never sent, traffic going through a proxy or Zscaler addresses in only one capture, and slower TLS or DNS.