RunLocalTools

HAR File Viewer — Waterfall, Request Inspector & Analyzer (Runs Locally)

Open .har files in your browser: filter requests, read the waterfall, inspect headers, payloads and responses, spot slow or insecure requests, and compare two captures. Free, no upload.

What it does

Drop in a .har file (the network recording you get from Chrome, Edge, Firefox, Safari, Charles or Fiddler) and it turns the raw JSON into something you can read. You get a sortable request table, a timing waterfall, a full inspector for every request, a report of performance and security findings, and a side-by-side comparison of two recordings.

You can open several files at once, each in its own tab, filter them down to what matters, and export what you find as a smaller HAR, CSV, JSON, a Markdown table, a cURL script, or a zip of the saved response bodies.

How it works

A HAR file is plain JSON: a list of entries, each with the request, the response, and a set of timings. The viewer parses it in your browser and works from that.

  • Request table. Thousands of rows stay smooth because only the rows on screen are drawn. The filter box understands things like status:4xx, method:POST, domain:cdn, larger-than:100k, slower-than:500ms, has:cookie and -type:img; plain words match the URL, and you can switch on regex or search headers and bodies as well.
  • Waterfall. Each bar is split into blocked, DNS, connect, TLS, send, wait (time to first byte) and receive. The HAR format counts TLS time inside connect, so the viewer separates it out rather than counting it twice. DOMContentLoaded and load markers come from the page timings in the file, and dragging across the time axis zooms and filters to that range.
  • Inspector. Headers, query parameters, cookies (with Secure, HttpOnly and SameSite flags), request payloads (JSON, form and multipart), response previews (JSON tree with search, images, HTML, text, hex for binary), a timing breakdown, and the raw entry. HTML previews run in a locked-down sandbox with scripts off and remote resources blocked.
  • Findings. Heuristic checks for failed requests, redirect chains, mixed content, uncompressed text, static files with no caching headers, duplicate requests, oversized images, CORS preflights, too many connections to one origin, risky cookie settings, tokens in URLs, and authorization headers. They are hints, not verdicts.
  • Compare. Two files are matched by method and URL (optionally ignoring the query string) and sorted into added, removed, changed and unchanged requests, with status, size and time differences.

How to use it

  1. Record a session: in Chrome or Edge open DevTools → Network, reproduce the problem, right-click the list and choose Save all as HAR with content. Firefox and Safari have similar “Save All As HAR” options.
  2. Drag the .har file onto the box on the right, or paste the HAR text. Add a second file if you want to compare.
  3. Use the filter box and the type and status chips to narrow the Requests view. Click a column header to sort; click a row to open it in the inspector.
  4. Switch to Waterfall to see where time went, or Insights for totals, third-party share, the slowest and largest requests, and the findings list. Click “Show in table” on any finding to jump to the requests behind it.
  5. Select rows (Ctrl/⌘-click or Shift-click) or just use the current filter, then export from the right-hand panel.
  6. Before taking a screenshot, turn on Screenshot-safe mode to mask cookie, authorization and token values.

What you can export

  • A smaller, valid HAR containing only the filtered or selected requests
  • CSV, JSON or a Markdown table of the request list
  • A cURL script for the requests, plus copy-as snippets for cURL, fetch, Node.js, Python requests, PowerShell and HTTPie
  • A zip of response bodies, named by request
  • The waterfall as SVG or PNG

If your CSV needs charting, send the table straight to the CSV/XML → chart tool. If a copied request needs converting between formats, the cURL ↔ fetch() converter handles that. When the inspector shows an Authorization: Bearer … header, paste the token into the JWT decoder to read its claims, and long JSON response bodies can be tidied with the JSON formatter.

FAQ

How do I get a HAR file from my browser?

In Chrome or Edge, open DevTools (F12), go to the Network tab, reload or repeat the action, then right-click the request list and choose “Save all as HAR with content”. Firefox offers “Save All As HAR” in the same place. Choose the “with content” option if you want to see response bodies; without it, bodies are not stored.

Why do some requests show no response body?

The browser only records bodies when you export with content, and it skips some responses entirely (redirects, cached items, very large files). The viewer tells you when a body is missing rather than showing an empty box.

Can I share a HAR file safely?

Treat it like a password file. HARs routinely contain session cookies, authorization headers, API keys in URLs and form data. The Insights tab lists where those appear. Screenshot-safe mode hides them on screen, but it does not change exports or response and payload bodies, so clean the file itself before sending it to anyone.

Why don’t the phase times add up to the total?

Browsers sometimes report a total time that includes work they do not break down, such as queueing before the request starts. The timing tab shows any unexplained remainder as “other” instead of hiding it. Also, in the HAR format TLS time is included in connect time; the viewer separates the two so the bar is not inflated.

How large a file can it open?

It is limited by your browser’s memory, not by a server. Files of a few hundred megabytes usually open; very large captures may be slow to parse. Narrowing the filter or closing other tabs helps. A warning appears for files over 25 MB.

Will my files still be here after a refresh?

Yes, by default. Open files are kept in your browser’s own storage so a refresh does not lose your work. You can switch that off with “Remember HAR files in this browser”, and “Close all & clear saved files” removes every saved copy.

Privacy

Everything in this tool runs locally in your browser. Your HAR file is read in the page, parsed in the page, and never uploaded. There are no features that use the internet, no accounts, and no tracking of what you open.

  • Saved copies. If “Remember HAR files in this browser” is ticked (it is by default), a copy of each open file is stored in your browser’s local storage on this device so it survives a refresh. It is never sent anywhere. Untick the box or use “Close all & clear saved files” to remove it, and note that anyone who can use this browser profile could see it.
  • HTML previews are rendered in a sandbox with scripts off and a policy that blocks every remote resource, so previewing a page from a HAR does not contact the sites it came from.
  • No libraries are downloaded. The viewer is self-contained; downloading a zip of bodies loads a small zip helper from a CDN the first time, which sends none of your data.

Limitations

  • Findings are heuristics and cannot see server-side configuration.
  • Response bodies appear only if the HAR was exported with content.
  • Very large files are bounded by browser memory.
  • PNG export is limited to the first 800 rows (SVG to 2,000) so the image stays within browser canvas limits.
  • WebSocket frames and HTTP/2 push details are not displayed.