HAR inspector · runs entirely in this tab

Read the whole trace
without sending it anywhere.

Drop in a HAR file and read every request, header and body that it contains. Snifflab has no permission to make network requests, so the cookies and sensitive items inside your trace cannot leave this tab.

or drop a .har anywhere on this page

I

Nothing is uploaded.

The page ships a Content Security Policy of connect-src 'none'. fetch, XHR, WebSocket and sendBeacon all fail at the browser level. This is not just a promise that we are making: the page simply does not have permission.

II

It works with no network at all.

Save this page to disk and open it over file://. It is the same tool, fully offline, on an air-gapped machine if that is what your trace requires. There is no hosted instance that you have to trust.

III

You can check for yourself.

Open DevTools and watch the Network tab while you work. It stays empty. The policy is in the <head> of this page, and the source is public.

Privacy

Snifflab runs entirely in this browser tab. There is no account, no server that receives your trace, and nothing about your session is recorded.

Your trace

When you open a HAR file, your browser reads it into memory and Snifflab parses it there. Snifflab never uploads it and never writes it anywhere. Close the tab and it is gone. Redaction and decoding happen in the same place, so a redacted copy was produced on your machine and did not travel anywhere first. The only file that ever leaves this tab is one that you deliberately save.

What is recorded

Nothing. Snifflab sets no cookies, writes nothing to local storage, and has no analytics, no error reporting and no telemetry of any kind. There is no third-party script, font or image on this page. The fonts are embedded in the file you are already reading.

Why this is not simply a promise

The page ships connect-src 'none' in its Content-Security-Policy, which makes fetch, XHR, WebSocket, EventSource and sendBeacon fail at the browser level. form-action 'none' blocks form submission as a way out. This is not a policy that we follow. It is a permission that the page does not have.

You can confirm it in about ten seconds. Open your browser's Network tab, load a trace, and watch it stay empty. The policy itself is in the <head> of this page, and the source is public.

If you would rather not trust the network at all, save this page to disk and open it from file://. It behaves identically, because everything it needs is already in the file.

The website

snifflab.dev is served as a static file by Cloudflare Pages. Like any web server, it sees the request for the page itself, including your IP address and the user agent your browser sends. That request is the only contact your browser makes with us, and it happens before you have opened anything. Whatever you do afterwards is not part of it.

Links

One link leaves this page, and it goes to Flytrap Industries. It opens in a new tab so that a loaded trace is not discarded, it carries no query string, and it sends no referrer, so the destination is not told where you came from. The build refuses to produce a file where that is untrue.

Changes

If any of this changes, it changes in this file, and this file is the product. There is no policy hosted elsewhere that could quietly say something different from the page you are holding.