How do I export a HAR file from my browser?

Open DevTools, go to the Network panel, reproduce the request, then right-click any row and choose Save all as HAR with content. Chrome, Edge, Firefox and Safari all offer some version of this.

Why does the generated cURL command not include -X POST?

Because --data-raw already implies POST, and adding -X on top can change how cURL handles redirects. The method flag is emitted only when it is actually needed, such as for PUT, PATCH or DELETE.

Is it safe to share a cURL command from a HAR file?

Not by default — a HAR captures live session cookies and Authorization headers, which are as good as a password. Turn on the strip option first, which removes Cookie, Authorization and common API-key headers.

Why are some headers left out of the command?

Browser-managed headers like Content-Length, Host and Connection are recalculated by cURL, and HTTP/2 pseudo-headers beginning with a colon are not valid to send manually. Including them causes errors rather than fidelity.

Is my HAR file uploaded when I convert it?

No. The file is parsed entirely in your browser, which matters because a HAR routinely contains session cookies and personal data from every request it captured.

HAR to cURL Converter

Turn requests captured in a browser HAR file into runnable cURL commands, with cookies and auth headers strippable.

HAR to cURL runs entirely in your browser. The archive is parsed on your device, so the session cookies a HAR contains never leave it.

Open the HAR File Viewer

About HAR to cURL

HAR to cURL reads the network archive your browser's DevTools exports and turns any request in it into a command you can paste into a terminal. It is the fastest way to close the gap on "it works in the browser but not from my script": every header, the method and the request body come across exactly as the browser sent them. Two details get handled carefully. Shell quoting uses the POSIX escape for a single quote inside single quotes, so a JSON body containing an apostrophe does not silently truncate the command. And because a HAR routinely contains live session cookies, a single toggle strips Cookie and Authorization headers before you paste anything into a bug report.

Features

Reads any HAR export and lists every request it contains
Filter by URL, method or status code
Convert one request or the whole filtered set at once
POSIX-correct quoting for bodies containing quotes or apostrophes
Strips Cookie, Authorization and API-key headers on request
Drops browser-managed headers like Content-Length and HTTP/2 pseudo-headers
Rebuilds form bodies from HAR params when no raw text was captured
Optional --compressed, -L and -k flags, and single- or multi-line output

How to use the HAR to cURL

In DevTools, open the Network panel and choose Save all as HAR with content
Drop the .har file here, or paste its contents
Pick a request from the list, or leave All selected to convert every one
Turn on strip cookies and auth if you plan to share the command, then copy it

Example

Input

POST https://api.example.com/login with a JSON body

Output

curl 'https://api.example.com/login' \
  -H 'Content-Type: application/json' \
  --data-raw '{"user":"jo"}' \
  --compressed

No -X flag is emitted for a POST that carries a body, because --data already implies it.

Common errors & troubleshooting

The command runs but the server returns 401 or 403. — The authentication header was probably stripped, or the session it carried has since expired. Turn off strip cookies and auth and re-export the HAR while logged in.
The tool says the JSON is not a HAR file. — A HAR has a top-level log object with an entries array. A saved response body or a copied JSON payload will not have that structure — re-export using Save all as HAR.
A request body is missing from the command. — Export with content included. Without it the HAR records headers but omits bodies, so there is nothing to put in --data-raw.
The command breaks when pasted into Windows CMD. — The quoting here is POSIX, which suits bash, zsh and Git Bash. On Windows use WSL or Git Bash, since CMD treats single quotes as literal characters.

Frequently asked questions

How do I export a HAR file from my browser?: Open DevTools, go to the Network panel, reproduce the request, then right-click any row and choose Save all as HAR with content. Chrome, Edge, Firefox and Safari all offer some version of this.
Why does the generated cURL command not include -X POST?: Because --data-raw already implies POST, and adding -X on top can change how cURL handles redirects. The method flag is emitted only when it is actually needed, such as for PUT, PATCH or DELETE.
Is it safe to share a cURL command from a HAR file?: Not by default — a HAR captures live session cookies and Authorization headers, which are as good as a password. Turn on the strip option first, which removes Cookie, Authorization and common API-key headers.
Why are some headers left out of the command?: Browser-managed headers like Content-Length, Host and Connection are recalculated by cURL, and HTTP/2 pseudo-headers beginning with a colon are not valid to send manually. Including them causes errors rather than fidelity.
Is my HAR file uploaded when I convert it?: No. The file is parsed entirely in your browser, which matters because a HAR routinely contains session cookies and personal data from every request it captured.

Related tools

HAR File Viewer — Open a HAR file and inspect the request waterfall, headers, timings and sizes, in your browser.
cURL to Fetch — Convert a curl command to a JavaScript fetch() call.
cURL to Python — Convert a curl command to Python requests code.
API Request Client — Send HTTP requests, build headers and params, inspect responses — your last 25 requests are saved locally.
cURL to Node.js (axios) — Convert a curl command to Node.js axios code.
URL Parser — Break a URL into its parts and list query parameters.