urltoolskit.org
URL utilities, in the browser
Say hi →

HAR URL extractor

every request in a .har · filter by host, status, type, size · CSV export

A HAR file is a complete record of what a page loaded, and DevTools' own viewer is not built for asking "which third-party hosts did this page contact" or "which requests 404'd". Drop the file here and get a filterable table plus the summary — total bytes, distinct hosts, redirects, failures, slowest request, largest response.

Summary

Requests

Ready.

How to use

  1. Record the HAR: DevTools → Network → load the page → right-click any request → Save all as HAR with content. (Without content is smaller and works fine here — only sizes and URLs are read.)
  2. Drop the file into the picker. It is read by the browser locally; nothing is uploaded.
  3. Use the filters. The Host dropdown is built from the file itself and ordered by request count, so the third parties are immediately visible.
  4. Read the Summary — total transferred, distinct hosts, redirect count, failures with the first few named, slowest request and largest response.
  5. Copy URL list gives you the filtered URLs, one per line, for the other tools here.

What to look for in a HAR

Distinct hosts. Each new host costs a DNS lookup, a TCP handshake and a TLS negotiation before a single byte of content arrives — on a slow connection that is hundreds of milliseconds each. A page contacting twenty hosts is usually contacting fifteen it does not need to. Filter by host to see what each one contributed.

Redirects. Every 3xx in the list is a wasted round trip. Chains are worse, and they hide in HARs because DevTools shows them as separate rows. If a script or image redirects, fix the URL in your markup rather than paying for the hop on every load.

4xx and 5xx. Failed requests that nobody noticed because the page still rendered — a missing font that fell back, a 404 favicon, an analytics endpoint returning 500. The filter surfaces them in one click.

Size outliers. The largest response is very often an unoptimised image or an un-tree-shaken bundle. Set a minimum size of 200 KB and see what is left.

Third-party URLs with your data in them. Sort by host, look at the query strings going to analytics and ad domains, and check what is in them. URLs sent to third parties often carry the full page URL as a referrer or dl parameter — and if your page URL contains an ID, an email or a token, you are sending that too. Copy the URL list and run it through the URL privacy audit.

FAQ

Is the HAR uploaded anywhere?

No. It is read with the browser's FileReader and parsed in the tab. This matters more than usual here: a HAR recorded on a logged-in session contains your cookies, Authorization headers and request bodies in full. Never send one to an online viewer you do not control, and sanitise before sharing it with anyone.

Why is a request's size zero?

Either it was served from cache (no bytes transferred), or the HAR was saved without content. The _transferSize field some tools add is not part of the HAR 1.2 spec, so this reads content.size and falls back to bodySize.

Can it show request and response headers?

Not in the table — that would be unreadable at a hundred rows. Pull the headers for the one request you care about out of the HAR and paste them into the HTTP header parser.

Does it work with HARs from other tools?

Yes — Firefox, Safari, Charles, Fiddler, Insomnia and Playwright all write HAR 1.2, and the fields read here (request.method, request.url, response.status, content.mimeType, time) are all standard.