HAR inspector · runs entirely in this tab
Drop in a HAR file and read every request, header and body that it contains. Snifflab has no permission to make network requests, so the cookies and tokens inside your trace cannot leave this tab. Not by accident. Not by design.
or drop a .har anywhere on this page
The page ships a Content Security Policy of
connect-src 'none'. fetch, XHR, WebSocket and
sendBeacon all fail at the browser level. This is not a
promise that we are making. It is a permission that the page does not
have.
Save this page to disk and open it over file://. It is the
same tool, fully offline, on an air-gapped machine if that is what your
trace requires. There is no hosted instance that you have to trust.
Open DevTools and watch the Network tab while you work. It stays empty.
The policy is in the <head> of this page, and the
source is public.