Perf Script Studio

Overview

Perf AutoCorrelator and Perf Migrator are now one tool. Both were built around the same internal model of a test plan, so keeping them apart meant maintaining two parsers, two sets of generators and two licences for one job. If you own either, your command name still works and this is a free upgrade — run update.

Three things, one binary:

• generate — a HAR recording in, a runnable JMeter, k6 or Gatling script out, with the values that change between runs already extracted, think times taken from the recording’s own timings, and parallel requests grouped the way the tool models them.
• correlate — point it at a script you already have and it reports the hardcoded session ids, CSRF tokens and JWTs that were valid when it was written and are stale on the next run.
• convert — JMeter, k6 and Gatling, in all six directions.

One price. Every feature, every direction, no tiers.

Supported Tools

Tool	Output Format	Variable Syntax
JMeter	.jmx (XML test plan)	${variableName}
Gatling	.scala (Simulation class)	#{variableName}
k6	.js (ES module)	let varName

Key Features

Auto-Correlation Engine

• One detection, multiple outputs - Detect correlations once, export to JMeter, Gatling, or k6
• 50+ detection patterns across 8 categories
• Value-shape detection - UUIDs, base64, JWTs, MongoDB ObjectIDs, long tokens
• Auto-substitution - Replace hardcoded values with variables in subsequent requests
• Boundary-based regex - Context-aware patterns like "token": "([^"]+)"

Pattern Categories

Category	Patterns	Examples
Standard	8	sessionId, csrfToken, userId, orderId
GraphQL	7	mutationId, cursor, subscriptionId
OAuth 2.0	11	authCode, accessToken, refreshToken, PKCE
Enterprise	18	Salesforce, SAP, Oracle, ServiceNow
WebSocket	6	connectionId, channelId, socketIoSid
Value shape	6	UUID, base64, JWT, MongoDB ObjectID

Built-in Tools

• PKCE Generator - SHA-256 code challenge pairs for OAuth
• JWT Decoder - Parse headers, payloads, and claims
• Batch Processing - Process multiple HAR/JMX/k6/Gatling files at once

CLI Usage

generate — Full runnable script from HAR (recommended starting point)

# Generate a complete JMeter test plan with think times, parallel groups, and correlations
perf-script-studio generate recording.har --tool jmeter -o test.jmx

# Generate a complete k6 script
perf-script-studio generate recording.har --tool k6 -o test.js

# Generate a complete Gatling simulation
perf-script-studio generate recording.har --tool gatling -o Simulation.scala

correlate — Extractor fragments for existing scripts

# Detect correlations and output extractors for an existing JMX
perf-script-studio correlate recording.har -f jmx -o extractors.jmx

# Detect from a JMX and merge extractors directly into it
perf-script-studio correlate script.jmx -f jmx -m -o script_correlated.jmx

# Gatling and k6 extractor fragments
perf-script-studio correlate recording.har -f gatling -o extractors.scala
perf-script-studio correlate recording.har -f k6 -o extractors.js

web — Embedded web UI (Pro only)

perf-script-studio web          # Starts on http://localhost:7070
perf-script-studio web --port 8080

Pricing

£99, one time. Every feature, all six conversion directions, perpetual licence, free updates. There is no cheaper tier and nothing is held back — the old £59 Basic and the single-direction migrator licence are both gone, and anyone holding either gets this build as a free upgrade by running update.

Existing AutoCorrelator Basic licences now unlock everything, at no charge. The web UI, value-shape detection and the enterprise pattern sets — Salesforce, SAP, Oracle, ServiceNow, OAuth and GraphQL — were all Pro-only. The merged build checks that a licence is valid and nothing else, so a Basic key opens the lot, including the six conversion directions Basic never had at any price.

Use Cases

Multi-Tool Team

Your team uses different tools? No problem:

1. Record HAR from browser DevTools
2. Run: perf-script-studio generate recording.har --tool jmeter -o test.jmx
3. Run: perf-script-studio generate recording.har --tool k6 -o test.js
4. Each team member gets a complete, ready-to-run script

OAuth 2.0 Flow Testing

1. Capture authorization redirect
2. Extract auth code and state automatically
3. Generate PKCE for public clients
4. Extract access/refresh tokens

GraphQL API Testing

1. Record HAR from GraphQL Playground
2. Detect mutation IDs, cursors, and subscription IDs
3. Export extractors to your preferred format

Installation

Windows (CLI)

1. Download the executable from the download page
2. Save to a convenient location (e.g., C:\Tools\perf-autocorrelator.exe)
3. You may see a SmartScreen warning - This is normal for new software
4. Click “More info” → “Run anyway”
5. The app is safe - SmartScreen just doesn’t recognize new publishers yet
6. Open Command Prompt or PowerShell
7. Run: perf-autocorrelator --version to verify installation
8. Enter your license key when prompted on first run

Linux (CLI)

1. Download the binary from the download page
2. Make it executable: chmod +x perf-autocorrelator
3. Move to system path: sudo mv perf-autocorrelator /usr/local/bin/
4. Run: perf-autocorrelator --version to verify installation
5. Enter your license key when prompted on first run

Web UI — Pro only

1. Download and install the Pro binary from the download page
2. Activate your license: perf-script-studio activate YOUR-LICENSE-KEY
3. Start the server: perf-script-studio web
4. Browser opens automatically at http://localhost:7070

The web UI is embedded inside the Pro binary — no separate file to download.

Technical Details

• Download size: ~5.5MB — one archive containing all three command names
• Processing: All correlation runs locally in the Rust binary — your data never leaves your machine
• Web UI access: Pro binary serves on localhost:7070 (or --port of your choice)
• Platforms: Linux x86_64, Windows x86_64

FAQ

What input formats are supported?

• HAR files from browser DevTools (Chrome, Firefox, Edge)
• JMeter JMX recordings from HTTP(S) Test Script Recorder
• k6 scripts (.js files)
• Gatling simulations (.scala files)

Can I use it for multiple projects?

Yes! Your license covers unlimited personal or commercial use. Use it on as many projects as you need.

How does value-shape detection work?

It recognises dynamic values by their shape rather than by name - UUIDs, base64-encoded strings, JWTs, MongoDB ObjectIDs and long random tokens - so it catches values no named pattern knows about. Each detector carries a confidence score you can threshold with --min-confidence. These are tuned regular expressions, not machine learning: there is no model, no inference and no network call, and it runs entirely on your machine.

Is my data safe?

Absolutely. Both the CLI and web app process everything locally. No data is ever sent to external servers. Your scripts and recordings stay on your machine.