Private HAR Viewer, Waterfall & Redaction Workbench
Inspect HAR requests, compare two captures and build a reviewed support package with selected requests, redaction evidence and real HAR output.
HAR Evidence Desk
Use the generated two-capture example to test errors, duplicates, cache evidence and redaction. Review retained fields before sending any output to another person.
Supported scope: Two UTF-8 HAR 1.2 files, each at most 20 MiB and 5,000 requests · 32 JSON nesting levels · 250,000 JSON values · 2,000 fields per header/query/cookie list · 60-second worker limit. JSON-shape body preview is limited to 1 MiB, 10,000 values and 20 levels; other body content is removed.
Local captures and redaction policy
Required fields are marked with an asterisk.
Your result
Review your output, then save it to your device.
Make the next step clear.
Your findings, assumptions and next steps will appear here after you run the check.
HAR Evidence Desk · https://har.kitforma.com/ · KitForma
Waterfall, byte accounting and cache evidence
Selected-request HAR plus redaction ledger
Two-capture timing and status comparison
Understand the evidence.
Focused guides explain the rules, the edge cases and the checks worth doing before you act.
Review a HAR before sending it to support
Minimize the capture, remove private fields and inspect the actual package.
Read the guide ↗Field guide / 02Read HAR waterfall and size evidence accurately
Separate connection phases, overlap, unknown byte counts and cache clues.
Read the guide ↗Field guide / 03Compare two HAR captures without hiding uncertainty
Match requests deliberately and interpret timing changes in context.
Read the guide ↗Before you start
Are my HAR files uploaded or requests replayed?
No. Parsing, filtering, redaction and ZIP generation run locally in a browser worker. The tool does not connect to domains inside your capture, execute response content, replay requests or send files to an analysis API.
Does redacted mean guaranteed anonymous?
No. Arbitrary secrets may appear in names, paths or free text, and timing/size patterns can reveal context. Defaults remove many fields and alias endpoints. Retaining more data requires a manual before/after review and recipient-specific judgment.
Why do timings not add up to page load?
Requests overlap. Summed request duration is different from the span between the earliest start and latest finish, and neither is automatically the browser load event. SSL is a part of connect. Missing phases and inconsistent browser values are reported rather than silently corrected.
Why are body sizes kept after removing body text?
HAR size fields describe captured traffic. They remain useful performance evidence after body text is removed, but are not the size of the rebuilt JSON payload. Unknown values remain -1 and are excluded from known-byte totals.
How are two captures matched?
Matching uses method, origin and path while ignoring query strings. Repeated keys are paired in capture order and flagged. Results are descriptive; different inputs, network conditions or cache state can invalidate a causal before/after interpretation.
What is inside the ZIP?
Only the rebuilt selected HAR, a value-free redaction ledger, performance evidence, a review README and an optional comparison report. There is no original HAR, no original filename and no list of your literal redaction terms. The output must still be reviewed under your chosen retention settings.
Sources & assumptions
Formats, algorithms and supported features are documented below. Check the stated scope and inspect your output before using it.
- HTTP Archive 1.2 format — historical draft ↗
Entry fields, timing semantics, body sizes and privacy considerations. This historical document is not a current W3C Recommendation.
- Chrome DevTools: Network reference ↗
Capturing and exporting request data; browser sanitization does not replace a review of your output.
- Firefox: Network request list ↗
Network capture and HAR export workflow.
Reviewed 2026-10-18. Read our methodology or report an issue.