HAR Viewer

A HAR file is what a browser’s network panel saves when you choose “Save all as HAR”: every request a page made, its headers, cookies and body, the response, and how long each step took. Support teams ask for one when a site misbehaves. This viewer opens it as a list with a waterfall, so you can see what failed, what was slow and what was large, and read any request in full — headers, query, body, response and timings — or copy it as a cURL command to run again. A HAR also holds the session cookies, bearer tokens and passwords the browser sent, so the viewer can make a copy with those removed before you share it.

1. In Chrome or Edge open DevTools (F12) → Network, reload the page, then right-click the list → “Save all as HAR”. Firefox: Network → the gear → “Save All As HAR”. Safari: Web Inspector → Network → Export.
2. Open the .har file here, or press “Try an example” to see a short page load with a failed image and a blocked script.
3. Read the summary — requests, failures, bytes transferred, the time to the load event — and the breakdown by type and by host.
4. Filter by words in the URL, by type, or to failures only; sort by start, slowest or largest. Select a request to see it in full and copy it as cURL.
5. Before sending the file to anyone, use “Download a copy safe to share”: credentials are replaced with [REDACTED], response bodies are removed unless you keep them, and the tool says how many values it removed.

• Redaction removes the values of credential headers (Authorization, Cookie, Set-Cookie, API keys, CSRF tokens and similar), every cookie, query and form fields with names like token, key, secret, password or code, the same names inside JSON bodies, and anything shaped like a JSON Web Token. A secret under an unusual name in a plain-text body can still get through: check the copy before you share it.
• Firefox and Safari do not record bytes transferred for every request, so totals cover only the requests that say; the summary shows how many.
• The whole file is read into memory, which a HAR with large response bodies can make big; a few hundred megabytes is the practical limit on most computers.
• Times are as the browser measured them on your machine, network and cache; another run will differ.
• A HAR file holds everything your browser sent and received, logins included. It is read here, in a background worker on your device, and never uploaded; the page works with the network switched off.

Not as saved. It contains your session cookies and any tokens the page sent, which can let someone act as you until they expire. Use “Download a copy safe to share”, check it, and send that instead.

The browser did not record one: Firefox and Safari leave the transfer size out for cached and some cross-origin responses, and a blocked request never had one. The tool shows — rather than a guessed zero.

Something in the browser — usually an ad or tracker blocker — stopped the request before it was sent. It is not a server error; the site never saw the request.

Select it and copy it as cURL, then run the command in a terminal. The command carries the original headers and body, credentials included, so treat it like a password.