See which trackers and third parties a web page talks to. Load a HAR export from your browser's DevTools, or paste page source, and get a local report. Nothing you load is uploaded.
Your file never leaves this device: the audit runs in your browser, and this tool makes no network requests. It cannot scan live sites by address: browsers' same-origin policy and CORS stop one site's page from reading another site's pages or traffic. You capture the traffic yourself and load it here. A HAR file can hold your cookies and login tokens, so don't share it publicly. The report masks those values.
How to save a HAR file (30 seconds)
Chrome / Edge: open the page, press F12, open the Network tab, reload the page, then click the download arrow (Export HAR). Newer Chrome versions strip cookies unless you choose to export with sensitive data.
Firefox: F12, then Network, reload, then the gear icon, then Save All As HAR.
Safari: enable the Develop menu, open Web Inspector, then Network, reload, then Export.
Browse the page for a moment before exporting (scroll, accept or reject the cookie banner) so delayed tags show up too.
No file loaded.
Source shows only the tags written into the page. Tags that load other tags at run time only appear in a HAR export.
Lists every file your browser has fetched for the page you are on right now, using the browser's own resource log, and sorts out anything that came from another site.
Load a HAR file, paste page source, or audit this page.
Findings
Third parties contacted
Grouped by host. Requests, cookies and size come from the HAR. Source and self-check modes count references only.
Host
Owner
Type
Requests
Cookies set / sent
KB
What this can and cannot tell you
It names third parties using a built-in list of about 200 well-known tracker, ad, analytics and infrastructure domains. A host that isn't on the list shows as an unknown third party, not as safe.
No live scanning: browser same-origin and CORS rules stop this page from loading or watching another site, so it only audits what you capture and load (or this page itself).
Findings are possible exposures, not confirmed data leaks. A flagged email or ID shows that the data appeared in a request to another site. It does not show what that company does with it, and it isn't a legal judgement.
The site's own domains are worked out from the page address (with common two-part endings such as .co.uk). A company's own CDN on a different domain will show as a third party unless you add it above.
A HAR only covers what happened while you were recording. Consent choices, logging in and scrolling all change what loads.