HAR File Viewer
Open a .har network log, read the waterfall, and export a copy with the credentials stripped out.
Upload an Excel file
Supports .xlsx and .xls formats
Conversion payloads stay in this browser tab and are never placed in page URLs - see how local processing works. Privacy-safe analytics record only the tool, outcome, and a coarse input-size bucket. Press Cmd/Ctrl + Enter to convert.
How to analyse a HAR file
Drop the .har file onto the panel. It is parsed locally into a request table and a waterfall, with totals for request count, bytes transferred, wall time, and failures. Filter by status class, resource type, method, domain, or URL substring; sort by time or size to find the outlier; then select a request to see its full timing breakdown, headers, and payloads. When you are ready to attach the archive to a ticket, export a redacted copy.
What a HAR file actually contains
HAR is a JSON format standardised by the W3C Web Performance group. Under log.entries, each element records one request: the start time, the total duration, a timings object breaking that duration into blocked, dns, connect, ssl, send, wait, and receive, the full request line with every header and cookie, and the response with status, headers, and — if the archive was saved "with content" — the response body. That completeness is what makes it useful for debugging and what makes it dangerous to pass around: an archive of an authenticated session contains everything needed to resume that session until the token expires.
Reading the waterfall
The horizontal position of each bar is when the request started relative to the first request in the log; its width is how long it took. Staircases of short bars mean requests are being discovered late — typically a script that fetches another script. A cluster of bars all starting at once with long Blocked segments means the browser hit its per-host connection limit. One long bar with a dominant Wait segment is a slow endpoint. Long Receive segments on text responses point at missing compression, which is called out separately in the summary.
| Input | Output | Note |
|---|---|---|
| Long Wait, short everything else | Server-side latency | Profile the endpoint. Front-end changes will not help. |
| Long Blocked, many parallel requests | Connection contention | HTTP/1.1 host limits, or too many separate assets. |
| Long Receive, text MIME, no Content-Encoding | Missing compression | Enable gzip, br, or zstd at the edge. |
| Repeated 3xx chain | Redirect cost | Each hop is a full round trip. Link to the final URL. |
Before you share a HAR file
Treat an unredacted archive as a credential. Export the redacted copy, narrow it to the requests that actually demonstrate the problem, and read the result before attaching it. Rotate any token that was already shared unredacted — masking a value after the fact does not un-share it. If the bug involves a response body containing personal data, use the option to drop bodies entirely; the timing and header information is usually what the person debugging needs anyway.
Frequently Asked Questions
Is it safe to open a HAR file here?
Safer than anywhere that uploads it. A HAR records every request the browser made, including Cookie and Authorization headers, so a captured archive frequently contains a live session token. This page parses the file in your own tab — there is no upload endpoint — and masks credential headers in the interface as soon as the file is read.
How do I create a HAR file?
In Chrome or Edge, open DevTools, go to the Network tab, tick "Preserve log", reproduce the problem, then right-click any request and choose "Save all as HAR with content". Firefox uses the same Network panel with "Save All As HAR". Safari exports from the Network tab's export button. Reproduce the issue in a fresh tab so the archive contains the failure and little else.
What does the timing breakdown mean?
Blocked is time queued behind connection limits or the browser's own scheduling. DNS is name resolution. Connect is the TCP handshake, with TLS shown separately inside it. Send is writing the request. Wait is time-to-first-byte — the server thinking. Receive is streaming the body. A slow request with a large Wait is a server problem; the same total with a large Receive is a size or bandwidth problem, and the fix is different.
What exactly does the redacted export remove?
Authorization, Proxy-Authorization, Cookie, Set-Cookie, the x-api-key / x-auth-token family and any x-*-token, -secret, -key, or -auth header, plus query parameters whose name looks like a credential. Cookie arrays are emptied. Optionally it also drops request and response bodies. Read the export before sharing it — automated redaction cannot know that a customer's email sits in a response body.
Why is the transferred size different from the content size?
Transferred is what came over the wire, including response headers and after compression. Content is the decoded body. A large gap means compression is working. A gap of zero on a text response usually means it was not compressed at all, which is what the uncompressed-assets warning is looking for.
Is my data uploaded anywhere?
No. The conversion runs in JavaScript inside the page you already downloaded. There is no upload endpoint on this site, nothing is written into the URL, and closing the tab discards everything. Analytics record the tool name, whether the run succeeded, and a coarse size bucket — never the content.
Related Tools
JSON Viewer
Open a large JSON file, search every key and value, filter with JSONPath, and copy any branch — without uploading a byte.
JWT Decoder
Decode and inspect JWT (JSON Web Tokens) instantly with our free online tool.
JSON Formatter & Beautifier
Format, beautify, and validate JSON in one pass, with the exact location of any syntax error.