HAR Waterfall Viewer

About HAR Analyzer

A HAR file is the recording every browser's network panel exports: each request the page made, with its timings, sizes and status. What people want from one is rarely the individual entries — it is where the time went, what was heaviest, what failed, and what should have come from the cache and did not.

The summary gives the request count, what was transferred against what it decompressed to, the wall time of the whole recording — which is not the sum of the requests, because they overlap — and the page's own load and DOM-ready timings when the file carries them.

Underneath are the findings worth acting on: failed requests, redirect chains, responses queued behind a busy connection, one response that is a third of everything transferred, large responses that arrived uncompressed, the same URL fetched twice, slow time to first byte, HTTP/1.1 connections, static files with no cache lifetime, and how much came from third parties.

The waterfall puts every request on one time axis, so position is when it started and length is how long it took. Each bar is split into the phases the browser went through — queued, DNS, connect, TLS, send, waiting for the first byte, download — and DOMContentLoaded and load are drawn across it. Hovering a bar gives its full address, status, size and phase timings.

Tables for the questions that follow: every request in start order, time by phase with medians and 95th percentiles, failed requests with the browser's reason, a caching and compression audit read from the response headers, hosts with their connections, protocols and first- or third-party status, and duplicate requests. Filter everything by resource type or by part of the URL.

To produce one: open the network panel, tick *preserve log*, reload the page, then right-click the request list and export. Note that a HAR holds full URLs, headers and often cookies — this reads it in your browser, but be careful where else you send it.

Where it helps

• Turns a recording of hundreds of requests into the handful of facts that explain the page.
• Names the specific faults — failures, redirects, queuing, one oversized response, missing compression — rather than only listing numbers.
• Groups by type and by host, which is how a third-party script problem becomes obvious.
• Draws a real waterfall with per-phase timing and page-load markers, so the shape of the load is visible at a glance.
• Audits Cache-Control and compression per file, and separates first-party from third-party hosts.
• Reads the file locally: a HAR usually contains cookies and tokens, and this one never leaves the browser.

Limits

• It reads what the recording says. A HAR made with the cache enabled, or with throttling on, describes that situation and not a first visit.
• Cache hits are inferred from a response that transferred no bytes; the caching audit reads the headers, but cannot see a service worker's own cache.
• First and third party are judged by domain name without the public suffix list, so an unusual suffix can be grouped wrongly.
• It does not replay requests, follow redirects or fetch anything itself.
• Rendering, scripting and layout are outside a HAR: it can say what arrived and when, not what the main thread then did with it.

Frequently asked questions

How do I export a HAR?

In Chrome or Edge: network panel, tick *preserve log*, reload, then right-click any request and choose *Save all as HAR*. Firefox and Safari have the same command under a different name.

Why is the wall time shorter than the sum of the request times?

Because requests overlap. The wall time is from the first request starting to the last one finishing, which is the number a person experiences.

What does a blocked time mean?

The request was queued before it could start, usually waiting for a free connection to the same host. A lot of blocked time is the classic sign of too many resources on one domain.

Is it safe to share a HAR?

Not casually — it usually contains cookies, authorization headers and full URLs. This tool reads it in your browser, but scrub the file before sending it to anyone else.

Related tools

• Log Analyzer — Summarise a log: rates, errors, slowest paths and busiest clients
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• Stack Trace Analyzer — Read a stack trace or crash in any common language: the cause, your frames, and what it usually means
• IDN Homograph Detector — Check whether a domain name is imitating another one
• Phishing URL Checker — Where a link really ends up, how old the domain is, and which tricks it uses

More Analyzers tools

• Log Analyzer — Summarise a log: rates, errors, slowest paths and busiest clients
• HAR Analyzer — A network recording as a waterfall: what was slow, heavy, uncached or failing
• IDN Homograph Detector — Check whether a domain name is imitating another one
• Phishing URL Checker — Where a link really ends up, how old the domain is, and which tricks it uses
• Injection Filter Tester — Standard probes per context, and whether your escaping survived them
• Stack Trace Analyzer — Read a stack trace or crash in any common language: the cause, your frames, and what it usually means