Can it decrypt HTTPS traffic?

No. Encrypted traffic shows as TLS or QUIC; the page shows the handshake, including the server name the browser asked for, but not the content. Wireshark can decrypt it if you also have the browser's key log file.

What is the difference between .pcap and .pcapng?

.pcap is the original format from tcpdump: one interface and a simple record per packet. .pcapng, Wireshark's default since 2012, can hold several interfaces, comments and the name of the capturing program. This page reads both.

How big a capture can it open?

Up to 1 GB, and the first 1.5 million packets are listed and filtered. For bigger captures, split them with Wireshark's editcap (editcap -c 1000000 big.pcapng part.pcapng) and open the part you need.

Is my capture uploaded?

No. The capture is read and decoded by this browser tab on your own device, which matters because captures often contain passwords, cookies and internal addresses.

Stays on your computer How this works

Free PCAP viewer: open Wireshark captures online

Open a .pcap or .pcapng network capture without installing Wireshark - see every packet, filter them, and read each one decoded layer by layer - entirely in your browser

Drag & drop a capture here, or browse

.pcap, .pcapng and .cap from Wireshark, tcpdump or tshark, gzipped too, up to 1 GB · nothing is uploaded

About this PCAP viewer

Network captures record every packet that crossed a network interface: Wireshark saves them as .pcapng, tcpdump and most routers, firewalls and security tools as .pcap (sometimes named .cap). They turn up in support tickets, security investigations and networking courses, and reading one normally means installing Wireshark - not possible on a locked-down work laptop, a Chromebook or a phone.

This page reads the capture and lists every packet with its time, addresses, protocol and a one-line summary, the way Wireshark does. It decodes Ethernet, VLANs, Wi-Fi, ARP, IPv4 and IPv6, ICMP, TCP and UDP, and on top of them DNS, HTTP, TLS (including the website name a browser asked for), DHCP, NTP, SIP and QUIC. Captures often hold passwords, cookies and private addresses, so it matters that this one is read on your computer and never uploaded. It is free to use, with no account and no upload limit, and it runs entirely in your browser: nothing is uploaded, and while the page stays open, a feature you have already used keeps working offline. For a browser's .har network log, use the HAR Viewer.

What you can do

Open .pcap and .pcapng captures from Wireshark, tcpdump, tshark, routers and firewalls, including gzipped ones
See every packet with its time, source, destination, protocol, length and a plain summary
Filter by protocol (dns, tls, http...), by port ("port 443"), by address, or by any text
See the protocols, busiest addresses and services in the capture, and click one to filter by it
Open any packet to read it decoded layer by layer, with its bytes in hex and the selected layer highlighted
See which websites were visited from DNS queries and TLS server names
Save the packet list, or just the filtered packets, as a CSV for Excel

How to open a PCAP file without Wireshark

Drop the .pcap or .pcapng file on the box above, or click it and choose the file.
Look at the statistics at the top for an overview; click a protocol or address to show only its packets.
Type in the filter box to narrow the list, then click a packet to see it decoded.

Questions

Can it decrypt HTTPS traffic?: No. Encrypted traffic shows as TLS or QUIC; the page shows the handshake, including the server name the browser asked for, but not the content. Wireshark can decrypt it if you also have the browser's key log file.
What is the difference between .pcap and .pcapng?: .pcap is the original format from tcpdump: one interface and a simple record per packet. .pcapng, Wireshark's default since 2012, can hold several interfaces, comments and the name of the capturing program. This page reads both.
How big a capture can it open?: Up to 1 GB, and the first 1.5 million packets are listed and filtered. For bigger captures, split them with Wireshark's editcap (editcap -c 1000000 big.pcapng part.pcapng) and open the part you need.
Is my capture uploaded?: No. The capture is read and decoded by this browser tab on your own device, which matters because captures often contain passwords, cookies and internal addresses.