{"title":"Read a HAR p95 Without Blaming the Wrong API","excerpt":"A browser HAR mixes request types. Learn what the analyzer counts, why ten samples put p95 at the maximum, and what to save before making a performance claim.","canonicalUrl":"https://automationtester.in/blog/tools-reviews/read-har-p95-without-guessing","category":{"name":"Tools & Reviews","slug":"tools-reviews"},"tags":["har","api-performance","percentiles","performance-testing"],"author":{"name":"Shashank Rawlani","url":"https://shashank.rawlani.com","linkedin":"https://www.linkedin.com/in/shashankrawlani/"},"datePublished":"2026-10-04T05:30:00.000Z","dateModified":"2026-10-14T10:26:49.467Z","coverImage":{"url":"https://ik.imagekit.io/automationtester/automationtester-in/blog/covers/v3/read-har-p95-without-guessing.webp","alt":"Ten request-duration bars rise across a dark chart. Nine green bars cluster near a horizontal marker; the final orange bar rises far above the group and reaches a separate high-tail marker."},"contentHtml":"<div class=\"callout callout-info\"> Export a sanitized HAR from the browser, then upload it to the <a href=\"https://automationtester.in/tools/api-response-time\">HAR Response Time Analyzer</a>. It reports the average, p50, p90, p95, p99, and the five slowest requests in that file. Check which requests the HAR contains before treating its p95 as an API target.</div>\n\n<p>A page feels slow and someone asks for “the API p95.” A browser network export includes more than one API call. It may include images, fonts, and a request that waited behind another operation. One number across all of those requests can send the investigation to the wrong service.</p>\n\n<h2 id=\"har-export\">Start with the capture</h2>\n\n<p>In Chrome DevTools, open Network, reproduce the journey, and export <em>HAR (sanitized)</em>. Chrome says that option omits sensitive <code>Cookie</code>, <code>Set-Cookie</code>, and <code>Authorization</code> headers. The analyzer reads the file in the browser. You can also select “Try a sample” first to see the report layout without preparing a capture.</p>\n\n<p>Upload the file. The top row shows request count, average time, p95, and p99. The next panels show all four percentiles, method and status counts, and the slowest URLs. Use the slowest list to find a request worth inspecting in DevTools; the report itself does not explain whether the delay was server work, transfer, or browser scheduling.</p>\n\n<h2 id=\"small-sample\">Ten requests, one slow tail</h2>\n\n<p>To test the calculation, the same parser was run with ten <code>GET /orders</code> HAR entries whose <code>time</code> values, in milliseconds, were:</p>\n\n<pre class=\"language-text\"><code class=\"language-text\">90  100  110  120  130  140  150  160  170  1800</code></pre>\n\n<p>The analyzer reported an average of <code>297 ms</code>, p50 of <code>130 ms</code>, p90 of <code>170 ms</code>, and both p95 and p99 of <code>1800 ms</code>. It uses a nearest-rank percentile: p95 selects rank <code>ceil(0.95 × 10) = 10</code>, the slowest observation. That result is correct for this sample. It does not establish that 5% of future requests take 1.8 seconds. Collect more representative traffic before making a performance promise.</p>\n\n<h2 id=\"har-scope\">What the report includes</h2>\n\n<p>The analyzer counts every HAR entry with a request and a <code>time</code> value. It does not filter to API URLs or a particular status code. A static asset can therefore become the “slowest endpoint.” Export a focused capture or separate requests by endpoint before comparing this result with an API service objective. For a controlled load test and repeatable thresholds, use the <a href=\"https://automationtester.in/tools/k6-generator\">k6 Script Generator</a> as a starting point and verify the script against the actual service.</p>\n\n<p><strong>Does p95 tell me which request was slow?</strong> The percentile is a value, not an identity. The slowest list provides URLs to investigate, but a HAR can contain several requests with the same duration.</p>\n\n<p><strong>Can I use a HAR from any browser session?</strong> Check its contents first. Chrome offers a separate export with sensitive data; use the sanitized option for this workflow and inspect the file before sharing it elsewhere.</p>\n\n<h2 id=\"har-apply\">Capture a sample you can compare</h2>\n\n<p>Capture one reproducible journey. Record the URL set, sample count, p95, and the slowest request. Then repeat the same journey under comparable conditions. If the sample mixes unrelated requests, narrow the capture before drawing a conclusion.</p>\n\n<h2 id=\"har-references\">HAR and percentile references</h2>\n<ul>\n<li><a href=\"https://developer.chrome.com/docs/devtools/network/reference#save-as-har\">Chrome DevTools Network reference</a>: sanitized HAR export and the sensitive-data option.</li>\n<li><a href=\"https://www.itl.nist.gov/div898/handbook/prc/section2/prc262.htm\">NIST Engineering Statistics Handbook, percentiles</a>: ranks and the interpretation of sample percentiles.</li>\n<li><a href=\"https://automationtester.in/tools/api-response-time\">AutomationTester.in HAR Response Time Analyzer</a>: upload flow and report fields.</li>\n</ul>"}