Utilia
Categories ▾
Language: en ▾

HAR File Viewer

Open a .har file in your browser to inspect requests, headers, cookies, timings and a waterfall, then sanitize it before sharing. Nothing is uploaded.

Warning: HAR files contain secrets. A HAR file records every request with its cookies, authorization tokens, form data (sometimes passwords) and personal data. This tool reads it only in your browser: nothing is uploaded. Before you share a HAR file with anyone, use “Sanitize and export” and check the result.

“Sanitize and export” downloads a copy without cookies, Authorization and other credential headers, and with token, password and key parameters redacted in URLs, form data and JSON bodies. Review it before sharing: URLs and response bodies can still contain personal data.

How to open a HAR file

  1. Drop your .har file on the drop zone or click it to choose the file. You can also paste the JSON into Or paste the HAR JSON and click Open HAR. To see how the viewer works first, click Load an example.
  2. The summary shows the number of Requests, the bytes Transferred, the decoded Resources (decoded) size, the Finish time of the last request and the page’s Load event when the file records it.
  3. Narrow the table with Filter URL (part of an address, or a method such as POST), Type (document, script, stylesheet, image, font, XHR / Fetch, media) and Status (2xx, 3xx, 4xx, 5xx or Failed (no response)). When the file contains several pages, a Page filter appears.
  4. Click a URL to open the Request details: general information, timing phases, request and response headers, query string parameters, cookies, the request body and the response body as plain text.
  5. Before sending the file to a colleague or a support team, click Sanitize and export to download a redacted copy.

What is a HAR file?

HAR (HTTP Archive) is a JSON format for recording what a browser loads. Chrome, Edge, Firefox and Safari can all export one from the Network panel of their developer tools (“Save all as HAR”). Each entry describes one request: method, URL, request headers and cookies, the posted data, the response status, headers and cookies, often the response body, and a breakdown of the time spent. Support teams ask for HAR files because they show exactly what happened on the network when a page was slow or broken.

The Waterfall column draws each request on a shared timeline, split into the phases defined by the HAR 1.2 specification: queued/blocked, DNS lookup, TCP connect, TLS handshake, send, waiting for the first byte (TTFB) and download. A long “Waiting (TTFB)” bar points to a slow server; long DNS or TLS bars to connection set-up; many requests that start late point to render-blocking resources. Requests in red failed or returned a 4xx or 5xx status.

Why HAR files are sensitive

A HAR file is a complete recording of your session. It usually contains your session cookies, Authorization headers with bearer tokens, API keys in URLs, CSRF tokens, and sometimes the passwords and personal details you typed into forms. Anyone who gets the file can often reuse those cookies or tokens to act as you until they expire. That is why this tool never uploads the file: it is parsed and displayed entirely in your browser tab.

Sanitize and export removes all request and response cookies, replaces the values of Cookie, Set-Cookie, Authorization, Proxy-Authorization, X-Api-Key, CSRF headers and any header whose name contains “token”, “secret” or “session” with [REDACTED], and redacts parameters such as access_token, id_token, code, password, api_key, key or signature in URLs, form data and JSON bodies. The status line tells you how many items were redacted. Sanitizing is a safety net, not a guarantee: names and email addresses in URLs, HTML pages and other response bodies are kept, so read the file before you share it. Revoking the session (logging out) after recording a HAR is also good practice.

Limits

Files up to 100 MB can be opened. The table lists the first 2,000 matching requests; use the filters to reach the others. Bodies longer than 200,000 characters are cut in the details view. Response bodies are always shown as text: HTML is never rendered and images are never displayed, and Base64 bodies are decoded only when their content type is textual.

Frequently asked questions

How do I export a HAR file from my browser?

Open the developer tools (F12), go to the Network tab, reload the page to record the requests, then right-click the request list and choose “Save all as HAR” (Chrome, Edge) or use the export button (Firefox, Safari). Enable “Preserve log” if the problem happens across a redirect.

Is my HAR file uploaded anywhere?

No. The file is read and parsed by JavaScript in your browser, and nothing is sent to a server. That matters because the file can contain your cookies and tokens.

Does "Sanitize and export" make a HAR file safe to share?

It removes the usual credentials: cookies, authorization headers, API keys and token or password parameters. It cannot recognise every secret, for example personal data inside an HTML page or a custom field name, so review the downloaded file before sharing it.

Why is the size different from the one in my browser?

When the file records the transfer size (_transferSize), that value is shown. Otherwise the body size plus the headers size is used, or the decoded content size. Compressed responses are therefore smaller in Transferred than in Resources (decoded).

Why do some requests show "failed" and no timing?

A status of 0 means the browser never received a response: the request was blocked by an extension, cancelled, refused by CORS or failed at the network level. The error text, when the browser saved it, appears in the details.

Related tools