Open a .har file or paste HAR JSON. See a waterfall of every request, filter slow and failed ones, and download a redacted copy that is safe to share.
A HAR file viewer lists every request a browser made while a page loaded, and this one draws each as a row with a bar. The bar starts where the request started, measured from the first request in the file, and its length is the request time. The bar is split into the seven phases a HAR records: blocked (waiting for a connection slot), DNS, connect, SSL, send, wait (the server thinking, often called time to first byte) and receive. A long wait segment points at a slow server or API. A long receive segment points at a large or slow download. A long blocked segment means the browser had too many requests in flight. The summary above the chart gives the number of requests, the transfer size, the total time from the first start to the last end, how many requests failed and the slowest one. With the built-in sample, 12 requests move 1.8 MB over 5.73 s, 3 fail, and the slowest is /api/recommendations at 2.33 s.
A HAR timing of -1 means the phase did not apply, for example no DNS lookup on a reused connection, and it is counted as 0. In the HAR 1.2 format the connect time already includes the SSL time, so the chart draws the TCP part and the SSL part as two segments instead of adding SSL twice, and SSL is never counted as more than connect. If a file's time is longer than its phases, the rest is drawn and listed as Other; if the phases add up to more than the stored time, the longer total is used. In the sample, the first request has blocked 4 ms, DNS 18 ms, connect 42 ms (36 ms of it SSL), send 1 ms, wait 210 ms and receive 28 ms, which adds up to 303 ms, the time stored in the file. A request failed when its status is 0 (blocked, cancelled or no response) or 400 and up. Redirects such as 301 are not failures. The type chips use the resource type when the file has one and the response content type or file extension when it does not. Slow only keeps requests over the number of milliseconds you set, 1000 by default; in the sample that leaves 3 requests.
A HAR file is not safe to post as it is: it holds cookies, authorization headers and tokens in URLs. By default this page hides the value of Cookie, Set-Cookie, Authorization, Proxy-Authorization and X-API-Key, and of any header, cookie or query parameter whose name contains token, secret, key, session, auth, password, signature or credential, or is sig, code, state, otp or nonce, in any case and after URL-decoding the name. It also hides JWT-looking and bearer-style values and user:password pairs inside URLs and headers. While values are hidden, the pasted source and every response body stay hidden too, because a body can hold anything. Turn on Show sensitive values to see them. Download a redacted HAR builds a new file from standard HAR fields only. It replaces every query and fragment value in every URL, all cookie values and sensitive header values with REDACTED, and leaves out all response bodies, request bodies and form parameters, custom fields, comments and original page ids. Sample: the redacted copy replaces 19 values and keeps the HAR 1.2 shape. Header values are matched by name and by pattern, so a secret in a header with an ordinary name and no recognisable pattern can remain. Read the copy before you share it.
A file can be up to 200 MB, and pasted text up to 20,000,000 characters. Larger files are refused with a message that does not repeat their content. Each request keeps at most 500 headers, cookies or query items, and text values are cut at 10,000 characters; a note tells you when the redacted copy was shortened. The page lists up to 50,000 requests and shows 200 rows at a time, with a button for more. Parsing a very large file happens in this tab, so the page can pause for a moment while it reads one. Only text is shown for a response body, never rendered as a page, cut to 2,000 characters, and base64 bodies are not decoded. The file must be a HAR with a log.entries list; other JSON is rejected. This page reads timings as recorded by the browser and does not measure anything itself, so it cannot tell you why a server was slow.
Use Open .har file and pick the file, or drag it onto the page, or paste its JSON into the box. A HAR file is JSON, so a 3 MB export from the Network tab of your browser developer tools opens in a moment and lists its requests as a waterfall.
Set Sort by to Slowest first, or tick Slow only and choose a limit such as 1000 ms. The Slowest tile in the summary names the single slowest request, and the colours in its bar show whether the time went to waiting for the server or to downloading.
In a HAR file -1 means the phase did not happen, for example no DNS or SSL on a connection that was already open. It is counted as 0. If the request time is longer than the phases, the rest appears as Other in the timing table.
It replaces every query and fragment value in URLs, all cookie values, and the values of Authorization, X-API-Key and any name containing token, secret, key, session, auth or password with REDACTED, and drops all request and response bodies, form parameters and custom fields. You can limit it to the requests currently shown, for example only the failed ones.
Not the original: it can contain session cookies and tokens that let someone act as you. Attach the redacted copy instead, and open it once here to check that no value you care about is left.
No. The file is processed in your browser and not uploaded, and its contents are not saved. The page counts visits with Google Analytics, using no file contents, URLs or names. Hidden values stay hidden unless you turn on Show sensitive values.