A HAR file is a complete recording of what a web page said to its servers: every request, every response, every header and, often, every body. That makes it the fastest way to understand which APIs a site really uses. It also makes it one of the most sensitive files a developer handles, because the same recording holds session cookies, bearer tokens and personal data.

This tool turns a HAR file, or a Fiddler Classic .saz archive, into an API summary that keeps the structure and drops the secrets. You get the list of hosts, endpoints with their path templates, GraphQL operations and tRPC procedures, the JSON shape of request and response bodies, and the names of the credentials each endpoint uses. You never get a value. The capture is parsed in your browser and is not uploaded.

What it does

Input. A HAR 1.2 file (JSON, as exported by Chrome, Firefox, Safari, Charles and similar tools) or a Fiddler Session Archive (.saz, a ZIP file). The format is detected from the first bytes, so the file extension does not matter. Limits: 256 MiB per file, 200,000 requests (the rest are dropped with a warning) and a two-minute time limit. For SAZ archives, one member may expand to at most 64 MiB and all members together to at most 512 MiB.

Report. The summary contains:

Totals: number of requests, number of distinct endpoints, request and response bytes, and the producer recorded in the HAR (for example “Chrome 140”).
Hosts: every host with its request count and byte count, and whether it is first or third party. The first-party site is the registrable domain with the most requests; the report gives the share of requests that went to third-party sites.
Endpoints: grouped by method, host and path template. Id-like path segments are replaced by placeholders, so /api/users/42/orders and /api/users/97/orders become one row, /api/users/{id}/orders. Each endpoint lists its request count, HTTP status counts, average and maximum time, request and response content types, and the names of its query parameters.
GraphQL operations: requests to a GraphQL endpoint are split by operation, shown as query GetUser or mutation Login, including batched requests. Only the operation type and name are kept, never the query text or the variables.
tRPC procedures: paths such as /api/trpc/user.getById,post.list are recognized and the procedure names listed.
JSON shapes: for JSON bodies up to 2 MiB, the keys and value types (such as string, number|null, arrays and nested objects), merged across up to 20 samples per endpoint. Shapes are capped at 6 levels, 64 keys per object and 512 nodes.
Credentials: the authentication surface of each endpoint, as a name plus a fixed [redacted] marker ([REDACTED] in the JSON export) and the length of the longest value. For Authorization headers the scheme word, such as Bearer or Basic, is kept, and a JWT value is flagged as such.
Warnings: counts of things that were skipped, such as non-HTTP URLs (data:, blob:, WebSocket), Fiddler CONNECT tunnels, malformed sessions or truncated lists.

You can export the report as JSON. The export is the same redacted report, so it is safe to attach to a ticket in a way the raw HAR is not. It does include the file name you opened, which stays on your device.

How to capture a HAR or SAZ file

Only capture traffic from sites and accounts you are allowed to record, and preferably from a test account.

Chrome and other Chromium browsers

Open DevTools (F12) and switch to the Network panel. Tick Preserve log so navigations do not clear the list.
Reload the page and perform the actions you want to record.
Click the download icon in the action bar at the top of the Network panel and choose Export HAR (sanitized)…. Alternatively, right-click any request and choose Copy > Save all as HAR (sanitized).

Since Chrome 130, the exported HAR leaves out Cookie, Set-Cookie and Authorization headers by default. To export them, enable Settings > Preferences > Network > Allow to generate HAR with sensitive data; the export menu then also offers Export HAR (with sensitive data). Since Chrome 133 a single click on the export button opens that menu.

For this tool the sanitized export is usually enough: endpoints, shapes and query names are all still there. The difference is that removed headers cannot appear in the credentials list. If you need to see which endpoints send cookies or an Authorization header, use the export with sensitive data, analyze it here, and delete the HAR afterwards.

Firefox

Open the developer tools and switch to the Network tab. Enable Persist Logs in the settings menu if you want the log to survive reloads.
Record the actions.
Right-click in the request list and choose Save All As HAR, or use the same item in the Network toolbar’s menu of other actions.

Firefox does not apply Chrome’s sanitizing step, so treat its HAR as containing everything.

Fiddler Classic

Start Fiddler. To see HTTPS content, enable Tools > Options > HTTPS > Decrypt HTTPS traffic and trust Fiddler’s root certificate, ideally on a test machine.
Generate the traffic.
Choose File > Save > All Sessions… and save the .saz file. Do not set a password: encrypted archives are not supported.

How it works

The file is read in a Web Worker. A HAR file is parsed with JSON.parse and checked against the HAR 1.2 structure (log.entries, each with a request method, URL and response status). A SAZ file is opened as a ZIP archive. For each session, the raw request in raw/NN_c.txt and the raw response in raw/NN_s.txt are split into start line, headers and body, chunked bodies are decoded, and the timing is taken from the SessionTimers element in raw/NN_m.xml. The SAZ header and body split follows the SAZ reader on the main branch of REA, the open-source project by morluto (MIT); that reader is not part of the REA 6.4.0 npm release.

Each request is then normalized into method, URL, status, headers, content types and, for JSON bodies only, the body text. The summarizer turns that into the report and throws the values away:

Paths are split into segments, and a segment that is all digits, a UUID, a JWT, a date, a long hex string, an e-mail address or a token-like random string becomes {id}, {uuid}, {jwt}, {date}, {hex}, {email} or {token}. The query string and fragment are dropped.
A header or query parameter counts as a credential when its name is authorization, proxy-authorization, cookie, set-cookie or x-api-key, when the name contains a word such as token, secret, password, session, key, auth, signature or credential, or when the value is a JWT. Cookies are listed by cookie name.
Names that themselves look like values, such as a numeric JSON key, are replaced by the same placeholders.
A JSON body is reduced to keys and types before anything is stored.

How your capture stays private

The capture is not uploaded:

Parsing and summarizing run in a Web Worker on your device. Only the finished, redacted report is passed back to the page.
The report never stores header, cookie, query-parameter or body values. Redaction is done by construction: the values are never copied into the report, rather than copied and then masked.
Analytics events are coarse: success or an error code, a coarse range for the number of endpoints found (such as 11-100), a file-size bucket and a duration bucket. They never contain the file name, hosts, paths or any other content. The full list is on the privacy page.
The tool page shows no ads.

How to verify this yourself

Open your browser’s developer tools and switch to the Network tab before you choose a file. Analyze a capture and inspect every request: you only see page assets and the worker script /_astro/har-worker-*.js. None carries your file.
Or load the page, go offline (turn off Wi-Fi, or tick Offline in the Network tab) and analyze a file. It still works.
The worker runs under the Content Security Policy default-src 'none'; script-src 'self'; connect-src 'none', so the browser does not let it make any network request.

Limitations

No values, by design. You cannot read a token, a cookie or a response body here. Use the browser’s own tools for that.
Placeholders are heuristic. Ordinary slugs such as order-12345 stay literal, so the same endpoint can appear more than once. Conversely, a word segment is never treated as an id.
First party is a guess. It is the registrable domain with the most requests, computed with a small built-in list of two-label suffixes such as co.uk, not the full Public Suffix List.
Bodies are partly skipped. Only JSON-like bodies up to 2 MiB are shaped. HAR responses stored as base64 and compressed (gzip, br) SAZ bodies have no shape.
SAZ caveats. Password-protected archives, ZIP64 archives and HTTPS traffic that Fiddler did not decrypt (it appears as CONNECT tunnels) cannot be summarized. Requests in origin form are assumed to be HTTPS.
No WebSocket frames, no replay. The tool summarizes HTTP exchanges; it never sends a request.
A HAR shows only what was exercised. Endpoints you did not trigger during the capture are not in the report.

FAQ

It contains no header, cookie, query or body values, only names, types, counts and lengths. It still reveals hosts, path templates and API structure, and the file name you opened, so share it only where that is acceptable.

Why are there no cookies in the credentials list?

Probably because your HAR came from Chrome’s default sanitized export, which removes Cookie, Set-Cookie and Authorization. See the Chrome section above.

Does it support Fiddler Everywhere?

The parser follows the SAZ layout, which Fiddler Everywhere also uses. Archives saved with a password are rejected.

Why is a GraphQL request shown as anonymous?

The query had no operation name. Only the operation type is then known.

Can it open a HAR larger than 256 MiB?

No. Filter the capture before exporting, for example to Fetch/XHR requests only.

Compliance

Only analyze captures of your own traffic, of systems you own, or of systems you are authorized to test, and follow the site’s terms and the laws that apply to you. A HAR file can hold other people’s personal data; handle it accordingly and delete it when you are done. See the disclaimer.

HAR File Analyzer: Read, Summarize and Safely Share a HAR: export a HAR from each browser, read this report, and check a capture before you share it.
Trace Website API Calls with REA: Browser, HAR and Bundles: from a summary like this one to the JavaScript code that makes each call.
Reverse Engineer an Electron App with REA: ASAR, Preload, IPC: desktop apps built on web technology use the same APIs; the ASAR and Electron IPC analyzer maps their internal channels.

HAR and Fiddler SAZ API summarizer