HAR inspector · runs entirely in this tab

Read the whole trace
without sending it anywhere.

Drop in a HAR file and see every request, header and body that it contains. Snifflab's content-security policy blocks network requests. There is no login, and no need to connect to the cloud or create a workspace.The cookies and sensitive items inside your trace cannot leave this tab.

or drop a .har anywhere on this page

I

Nothing is uploaded.

We've built privacy into Snifflab from the ground up. The page ships connect-src 'none'; fetch, XHR, WebSocket and sendBeacon fail at the browser level. A build gate rejects navigation, WebRTC, external resources and unexpected URLs, then checks the completed single-file artifact before it can be deployed.

II

It works with no network at all.

Save this page to disk and open it over file://. It is the same tool, fully offline, on an air-gapped machine if that is what your trace requires. There is no hosted instance that you have to trust.

III

You can check for yourself.

Open DevTools and watch the Network tab while you work. It stays empty. The policy is in the <head> of this page, and the shipped artifact can be checked independently.

Privacy

Snifflab runs entirely in this browser tab. There is no account, no server that receives your trace, and nothing about your session is recorded.

Your trace

When you open a HAR file, your browser reads it into memory and Snifflab parses it there. Snifflab never uploads it and never writes it anywhere. Close the tab and it is gone. Redaction and decoding happen in the same place, so a redacted copy was produced on your machine and did not travel anywhere first. The only file that ever leaves this tab is one that you deliberately save.

What is recorded

Nothing. Snifflab sets no cookies, writes nothing to local storage, and has no analytics, no error reporting and no telemetry of any kind. There is no third-party script, font or image on this page. The fonts are embedded in the file you are already reading.

Why this is not simply a promise

The page ships connect-src 'none' in its Content-Security-Policy, which makes fetch, XHR, WebSocket, EventSource and sendBeacon fail at the browser level. form-action 'none' blocks form submission as a way out. The build separately rejects navigation and WebRTC primitives, external resources and unexpected URLs before checking the completed single-file artifact.

You can confirm it in about ten seconds. Open your browser's Network tab, load a trace, and watch it stay empty. The policy itself is in the <head> of this page, and the shipped artifact can be checked independently.

If you would rather not trust the network at all, save this page to disk and open it from file://. It behaves identically, because everything it needs is already in the file.

The website

snifflab.dev is served as a static file by Cloudflare Pages. Like any web server, it sees the request for the page itself, including your IP address and the user agent your browser sends. That request is the only contact your browser makes with us, and it happens before you have opened anything. Whatever you do afterwards is not part of it.

Links

Two links leave this page: one to Flytrap Industries, and one to a Stripe payment page for supporting Snifflab. Both open in a new tab so that a loaded trace is not discarded, both carry no query string, and both send no referrer, so the destination is not told where you came from. The build refuses to produce a file where that is untrue.

Changes

If any of this changes, it changes in this file, and this file is the product. There is no policy hosted elsewhere that could quietly say something different from the page you are holding.