How do I save a HAR file from my browser?
- Chrome: in the DevTools Network panel, right-click a request and choose Copy → Save all as HAR (sanitized), or press Export HAR (sanitized)… in the bar at the top of the panel [2].
- Firefox: in the Network Monitor, right-click a request and choose Save All As HAR [3].
Both write the requests listed in the panel at that moment. Reload the page with the panel open first, so the file holds the calls you want.
Does Postman import a HAR file?
Postman's import page, checked on the date above, lists what it reads: files exported from Postman (collections, environments, globals and data dumps), API definitions such as OpenAPI, AsyncAPI, protobuf and GraphQL, cURL commands, Git repositories, and data from SoapUI, Hoppscotch, Insomnia and Thunder Client [1]. It does not name HAR.
This guide does not depend on it. Each way below ends in a collection or a cURL command, which Postman lists.
Way 1: how do I turn one call into Postman with cURL?
- In the Network panel, right-click the request and choose Copy → Copy as cURL [2][3].
- In Postman, choose Use resources or import, open the Import tab, paste the command, and choose Import Into Collection to keep it, or Import without saving to just open it [1]. You can also paste a cURL command straight into a request's address box [1].
Good for one call or a few. For a whole flow, it is slow.
Way 2: how do I turn a HAR file into a Postman collection with RequestFox?
- In RequestFox, open Compose, go to Import & export and press Import a collection…. Pick the
.harfile. RequestFox saves the requests in it as a collection you can send, copy as code or edit. - Open the collection's More menu and choose Export to Postman…. If the collection holds a real token, password, API key or cookie, RequestFox asks first. The default button, Export without credentials, writes each one as a
{{variable}}for you to fill in. - In Postman, choose Use resources or import, open the Import tab and pick the file [1]. The file is a Postman Collection v2.1.
Reading a HAR, RequestFox leaves out the Cookie header, Host, Connection, Content-Length and HTTP/2 pseudo-headers. It keeps the other headers, Authorization included, so take secrets out of the HAR first or let the export remove them.
Way 3: how do I skip the HAR and record in RequestFox?
If you can reproduce the flow, record it again. Press Start in RequestFox, use the site, press Stop, then press Export (bottom right) and choose Postman Collection. Sessions you recorded earlier are in History: on a session, ··· More → Postman. No HAR file with your tokens in it is needed, and RequestFox redacts Authorization headers, cookies and secret-shaped fields by default in what you view or export. How to record API calls.
What should I remove from a HAR file before I share it?
A HAR is a copy of what your browser sent and received. Chrome leaves Cookie, Set-Cookie and Authorization headers out of the file by default, and only includes them if you turn on a setting and choose the "with sensitive data" export [2]. Tokens can also sit in an address, a request body or an answer, so read the file before you send it to anyone. If you use Firefox, check what its file holds.
RequestFox's Security mark flags some of these as you record, such as a token in an address.
Sources
- Postman Docs, "Import data into Postman". Checked . learning.postman.com
- Chrome for Developers, "Network features reference". Checked . developer.chrome.com
- Firefox Source Docs, "Network request list". Checked . firefox-source-docs.mozilla.org
Something here out of date? Tools change. Tell us at the address in the privacy policy and we will fix it.
Next
- Postman Interceptor alternative
Capture in the browser on its own, or hand the capture to Postman.
- Record API calls
Start, use the site, read the flags, keep the evidence.
- RequestFox vs Postman
Browser capture and flags, or team workspaces and more protocols.