HAR to OpenAPI Converter

No. The file is read, cleaned and turned into a spec inside your browser. This page makes no network call with it.

The same things the HAR viewer's cleaner removes: Cookie, Set-Cookie, Authorization and Proxy-Authorization headers, every cookie list, and the values of headers, query parameters, form fields and JSON keys whose names contain token, key, secret, password, session, auth, sig, jwt, csrf, xsrf, credential, bearer or otp. Example values are off unless you tick the box, and even then they come from the cleaned copy.

A path part that is a number, a UUID, a long hex string or a long mixed-case code becomes a parameter, named after the part before it. So /products/101 and /products/102 become one endpoint, /products/{productId}.

No. It describes only the calls in the file. A field is marked required when every sample had it, and a type comes from the values seen. Read it and fix names and types before you rely on it.

They are not API calls, so page loads, static files and CORS preflight requests are left out. Tick Include pages and static files to describe them too.

If calls carried a bearer token, a login cookie or a key in a header or the query string, the spec lists that sign-in method by its name. The value itself is never copied.