HAR Viewer & Request Timeline
Inspect a HAR locally, filter requests and compare response timings. Mask common credential headers and secret query parameters by default.
Read a browser network capture
Export a HAR from your browser’s network panel, choose the file or paste its JSON, then run. Filter by method, URL text or failed status. Expand a request for phase timings and headers. The timeline uses the earliest matching start and latest finish; summed request time is different because requests can overlap.
A timing or body size of -1 is shown as unknown rather than zero. TLS time is part of connect time in HAR and is not added again. Response bodies, POST bodies and cookie lists are excluded from the report. The original input stays in your browser.
Privacy and file limits
Common Authorization, Cookie, Set-Cookie and API-key headers are masked by default, as are query keys containing token, password, secret, key or signature. This is best-effort masking: URLs, paths and nonstandard header names may still contain private data. Review any report before sharing. The viewer never replays requests or fetches captured URLs.
Use UTF-8 HAR JSON. Limits: 10 MiB of input, 1,000 requests, 64 nesting levels, 200,000 JSON values and 1,000,000 report characters. Large response bodies count toward the input limit even though they are omitted from results. Parsing runs in a cancellable worker with a 10-second deadline.
Questions & answers
Why do response byte totals look smaller than a browser transfer total?
The report sums known response bodySize values only. Unknown sizes, headers, compression and browser cache accounting can differ; this is not an exact wire-transfer meter.
Can I reveal masked headers?
Yes. Turn off Mask common secrets and run again. Input and output remain local, but the resulting clipboard or downloaded report can contain credentials.