HTTP Toolkit
@httptoolkit.com
Beautiful & open-source tools to debug, test and develop with HTTP(S).
👨🔧 Built by @pimterry.fyi
🌐 https://httptoolkit.com/
🦣 http://mastodon.social/@httptoolkit
👨🔧 Built by @pimterry.fyi
🌐 https://httptoolkit.com/
🦣 http://mastodon.social/@httptoolkit
If you like turning HTTP into code, you'll be excited to hear that HTTP Toolkit can now export requests as ready-to-use code for:
- Rust's Reqwest library
- Ruby's Faraday library
- Crystal's built-in APIs
- Spring RestClient on the JVM
Plus plenty of other fixes & tweaks to improve other cases.
- Rust's Reqwest library
- Ruby's Faraday library
- Crystal's built-in APIs
- Spring RestClient on the JVM
Plus plenty of other fixes & tweaks to improve other cases.
November 12, 2025 at 5:36 PM
If you like turning HTTP into code, you'll be excited to hear that HTTP Toolkit can now export requests as ready-to-use code for:
- Rust's Reqwest library
- Ruby's Faraday library
- Crystal's built-in APIs
- Spring RestClient on the JVM
Plus plenty of other fixes & tweaks to improve other cases.
- Rust's Reqwest library
- Ruby's Faraday library
- Crystal's built-in APIs
- Spring RestClient on the JVM
Plus plenty of other fixes & tweaks to improve other cases.
Want to quickly get a curl request into HTTP Toolkit's Send tool, to start tweaking & testing parameters?
If you paste curl commands directly into the Send page URL bar, it'll now automatically parse it and fill out all the fields for you ✨
If you paste curl commands directly into the Send page URL bar, it'll now automatically parse it and fill out all the fields for you ✨
October 28, 2025 at 2:11 PM
Want to quickly get a curl request into HTTP Toolkit's Send tool, to start tweaking & testing parameters?
If you paste curl commands directly into the Send page URL bar, it'll now automatically parse it and fill out all the fields for you ✨
If you paste curl commands directly into the Send page URL bar, it'll now automatically parse it and fill out all the fields for you ✨
The best feature requests are the ones where the feature is already live 😀 github.com/httptoolkit/...
Did you know you can breakpoint requests & responses in live traffic with HTTP Toolkit, to modify them, inject a response or simulate errors?
Did you know you can breakpoint requests & responses in live traffic with HTTP Toolkit, to modify them, inject a response or simulate errors?
Add breakpoint-style debugging for app traffic · Issue #805 · httptoolkit/httptoolkit
It would be amazing if HTTP Toolkit could include a feature similar to browser DevTools breakpoints, but for app network requests. Right now, HTTP Toolkit lets you intercept, view, and mock request...
github.com
October 27, 2025 at 8:58 AM
The best feature requests are the ones where the feature is already live 😀 github.com/httptoolkit/...
Did you know you can breakpoint requests & responses in live traffic with HTTP Toolkit, to modify them, inject a response or simulate errors?
Did you know you can breakpoint requests & responses in live traffic with HTTP Toolkit, to modify them, inject a response or simulate errors?
Multi-step HTTP rules are now live! 🪜
As the first new steps, you can now add custom delays during processing to simulate latency, and attach request and/or response webhooks to rules to fire data out from HTTP Toolkit for matched traffic. More to come soon!
As the first new steps, you can now add custom delays during processing to simulate latency, and attach request and/or response webhooks to rules to fire data out from HTTP Toolkit for matched traffic. More to come soon!
October 14, 2025 at 10:51 AM
Multi-step HTTP rules are now live! 🪜
As the first new steps, you can now add custom delays during processing to simulate latency, and attach request and/or response webhooks to rules to fire data out from HTTP Toolkit for matched traffic. More to come soon!
As the first new steps, you can now add custom delays during processing to simulate latency, and attach request and/or response webhooks to rules to fire data out from HTTP Toolkit for matched traffic. More to come soon!
Another year of paying #opensource maintainers for their hard work 🦾 alongside the rest of the OpenSourcePledge.com businesses, and to celebrate: we're back up on the NASDAQ tower in Times Square!
October 9, 2025 at 5:21 PM
Another year of paying #opensource maintainers for their hard work 🦾 alongside the rest of the OpenSourcePledge.com businesses, and to celebrate: we're back up on the NASDAQ tower in Times Square!
Reverse engineering can be intimidating, but modern tools are fantastic, and it's honestly easier than it sounds to get started digging into app's internals and changing their their behaviour.
Take a look at the HTTP Toolkit guide for a quick intro: httptoolkit.com/blog/android...
Take a look at the HTTP Toolkit guide for a quick intro: httptoolkit.com/blog/android...
Reverse engineering & modifying Android apps with JADX & Frida
I get a lot of emails from users who want to know exactly what their favourite Android app is doing, and want to tweak and change how that works for...
httptoolkit.com
October 7, 2025 at 1:27 PM
Reverse engineering can be intimidating, but modern tools are fantastic, and it's honestly easier than it sounds to get started digging into app's internals and changing their their behaviour.
Take a look at the HTTP Toolkit guide for a quick intro: httptoolkit.com/blog/android...
Take a look at the HTTP Toolkit guide for a quick intro: httptoolkit.com/blog/android...
Want to dig into traffic byte-by-byte, to read your TLS handshakes and TCP packets directly?
With the new support for keylog files in the Pro settings, you can now integrate HTTP Toolkit into tools like Wireshark 🦈
With the new support for keylog files in the Pro settings, you can now integrate HTTP Toolkit into tools like Wireshark 🦈
October 2, 2025 at 2:12 PM
Want to dig into traffic byte-by-byte, to read your TLS handshakes and TCP packets directly?
With the new support for keylog files in the Pro settings, you can now integrate HTTP Toolkit into tools like Wireshark 🦈
With the new support for keylog files in the Pro settings, you can now integrate HTTP Toolkit into tools like Wireshark 🦈
Reposted by HTTP Toolkit
¡Enhorabuena a @httptoolkit.com por obtener el Sello Ayuda Efectiva como empresa de alto impacto!
La empresa ha donado al menos un 0,7% de sus ingresos a los programas benéficos más efectivos.
🏅 Página de certificación e impacto:
ayudaefectiva.org/empresa/http...
La empresa ha donado al menos un 0,7% de sus ingresos a los programas benéficos más efectivos.
🏅 Página de certificación e impacto:
ayudaefectiva.org/empresa/http...
September 23, 2025 at 6:38 AM
¡Enhorabuena a @httptoolkit.com por obtener el Sello Ayuda Efectiva como empresa de alto impacto!
La empresa ha donado al menos un 0,7% de sus ingresos a los programas benéficos más efectivos.
🏅 Página de certificación e impacto:
ayudaefectiva.org/empresa/http...
La empresa ha donado al menos un 0,7% de sus ingresos a los programas benéficos más efectivos.
🏅 Página de certificación e impacto:
ayudaefectiva.org/empresa/http...
Redirecting traffic? HTTP Toolkit transform rules just gained a long list of new options, including arbitrary regex match & replace logic, precisely targeted for every URL component - fully combinable with all the other existing request & response transforms.
August 21, 2025 at 5:22 PM
Redirecting traffic? HTTP Toolkit transform rules just gained a long list of new options, including arbitrary regex match & replace logic, precisely targeted for every URL component - fully combinable with all the other existing request & response transforms.
Reposted by HTTP Toolkit
I've been doing some ridiculously neat reverse engineering recently.
Check this out: github.com/httptoolkit/...
That code is modifying functions inside Flutter apps, without debug info, by *fingerprinting known chunks of assembly* for each CPU architecture, and then scanning memory to find them 🤯
Check this out: github.com/httptoolkit/...
That code is modifying functions inside Flutter apps, without debug info, by *fingerprinting known chunks of assembly* for each CPU architecture, and then scanning memory to find them 🤯
github.com
July 24, 2025 at 5:31 PM
I've been doing some ridiculously neat reverse engineering recently.
Check this out: github.com/httptoolkit/...
That code is modifying functions inside Flutter apps, without debug info, by *fingerprinting known chunks of assembly* for each CPU architecture, and then scanning memory to find them 🤯
Check this out: github.com/httptoolkit/...
That code is modifying functions inside Flutter apps, without debug info, by *fingerprinting known chunks of assembly* for each CPU architecture, and then scanning memory to find them 🤯
Want to script your own MitM proxy? You can use HTTP Toolkit's internals standalone via Mockttp, a JS library to build HTTP, WebSocket & TLS intercepting proxies: github.com/httptoolkit/...
v4 just went live: advanced URL regex rewriting, delay mixins, and non-HTTP proxying too 🚀
v4 just went live: advanced URL regex rewriting, delay mixins, and non-HTTP proxying too 🚀
GitHub - httptoolkit/mockttp: Powerful friendly HTTP mock server & proxy library
Powerful friendly HTTP mock server & proxy library - httptoolkit/mockttp
github.com
June 17, 2025 at 4:01 PM
Want to script your own MitM proxy? You can use HTTP Toolkit's internals standalone via Mockttp, a JS library to build HTTP, WebSocket & TLS intercepting proxies: github.com/httptoolkit/...
v4 just went live: advanced URL regex rewriting, delay mixins, and non-HTTP proxying too 🚀
v4 just went live: advanced URL regex rewriting, delay mixins, and non-HTTP proxying too 🚀
Reposted by HTTP Toolkit
Having a rooted android device with man-in-the-middle http capture using #httptoolkit is so much fun. It's crazy how much evil shit the apps are up to 🤯
https://httptoolkit.com/
ALWAYS use the website instead of the app if possible.
#android #infosec
https://httptoolkit.com/
ALWAYS use the website instead of the app if possible.
#android #infosec
Intercept, debug & build with HTTP
Beautiful, cross-platform & open-source tools for debugging, testing and building with HTTP(S), on Windows, Linux & Mac.
httptoolkit.com
May 21, 2025 at 10:45 AM
Having a rooted android device with man-in-the-middle http capture using #httptoolkit is so much fun. It's crazy how much evil shit the apps are up to 🤯
https://httptoolkit.com/
ALWAYS use the website instead of the app if possible.
#android #infosec
https://httptoolkit.com/
ALWAYS use the website instead of the app if possible.
#android #infosec
Reposted by HTTP Toolkit
It's been a long time coming but the http QUERY method spec is nearly done www.ietf.org/archive/id/d...
The HTTP QUERY Method
This specification defines a new HTTP method, QUERY, as a safe, idempotent
request method that can carry request content.
www.ietf.org
May 22, 2025 at 3:05 AM
It's been a long time coming but the http QUERY method spec is nearly done www.ietf.org/archive/id/d...
Some major performance updates have gone live this week 🚀
With a big internal redesign, memory usage just dropped 40%, and processing input got up to 50x (!) faster. A nice drop in CPU while intercepting, but a huge boost when you load a HAR of 100s of thousands of requests.
With a big internal redesign, memory usage just dropped 40%, and processing input got up to 50x (!) faster. A nice drop in CPU while intercepting, but a huge boost when you load a HAR of 100s of thousands of requests.
April 11, 2025 at 9:48 AM
Some major performance updates have gone live this week 🚀
With a big internal redesign, memory usage just dropped 40%, and processing input got up to 50x (!) faster. A nice drop in CPU while intercepting, but a huge boost when you load a HAR of 100s of thousands of requests.
With a big internal redesign, memory usage just dropped 40%, and processing input got up to 50x (!) faster. A nice drop in CPU while intercepting, but a huge boost when you load a HAR of 100s of thousands of requests.
What's going on with HTTP/3, where are the problems, and what comes next?
HTTP/3 is everywhere but nowhere
HTTP/3 has been in development since at least 2016, while QUIC (the protocol beneath it) was first introduced by Google way back in 2013. Both are now...
httptoolkit.com
March 12, 2025 at 4:37 PM
What's going on with HTTP/3, where are the problems, and what comes next?
Widespread HTTP compression dictionary support is slowly coming to the web...
Gecko: Intent to prototype: IETF HTTP Compression Dictionaries
Gecko: Intent to prototype: IETF HTTP Compression Dictionaries
Gecko: Intent to prototype: IETF HTTP Compression Dictionaries
groups.google.com
March 11, 2025 at 4:25 PM
Widespread HTTP compression dictionary support is slowly coming to the web...
There's an updated version of the exciting new HTTP QUERY method spec released today: https://www.ietf.org/archive/id/draft-ietf-httpbis-safe-method-w-body-08.html. Great to see progress here.
If you're unaware of it, there's more background on the HTTP Toolkit blog:
If you're unaware of it, there's more background on the HTTP Toolkit blog:
Defining a new HTTP method: HTTP QUERY
Nothing is ever finished or perfect, and HTTP is no exception. HTTP QUERY is a new HTTP method, for safe requests that include a request body. It's still...
httptoolkit.com
February 25, 2025 at 8:51 AM
There's an updated version of the exciting new HTTP QUERY method spec released today: https://www.ietf.org/archive/id/draft-ietf-httpbis-safe-method-w-body-08.html. Great to see progress here.
If you're unaware of it, there's more background on the HTTP Toolkit blog:
If you're unaware of it, there's more background on the HTTP Toolkit blog:
HTTP Toolkit arm64 builds landing imminently! Linux & Mac for now, Windows once GitHub CI support is fully available.
If you want to test it, you can download the latest server distributable from github.com/httptoolkit/... to run this locally today (see github.com/httptoolkit/... for instructions).
If you want to test it, you can download the latest server distributable from github.com/httptoolkit/... to run this locally today (see github.com/httptoolkit/... for instructions).
Test out building linux arm64 too · httptoolkit/httptoolkit-server@21bb1cf
The backend of HTTP Toolkit. Contribute to httptoolkit/httptoolkit-server development by creating an account on GitHub.
github.com
February 24, 2025 at 12:21 PM
HTTP Toolkit arm64 builds landing imminently! Linux & Mac for now, Windows once GitHub CI support is fully available.
If you want to test it, you can download the latest server distributable from github.com/httptoolkit/... to run this locally today (see github.com/httptoolkit/... for instructions).
If you want to test it, you can download the latest server distributable from github.com/httptoolkit/... to run this locally today (see github.com/httptoolkit/... for instructions).
You can now sponsor https://frida.re on GitHub to help fund development of Frida, which forms the backbone of plenty of reverse engineering techniques & tools.
HTTP Toolkit just signed up as the first sponsor! You can help support them too here:
HTTP Toolkit just signed up as the first sponsor! You can help support them too here:
Sponsor @frida on GitHub Sponsors
Support frida's open source work
github.com
December 12, 2024 at 3:36 PM
You can now sponsor https://frida.re on GitHub to help fund development of Frida, which forms the backbone of plenty of reverse engineering techniques & tools.
HTTP Toolkit just signed up as the first sponsor! You can help support them too here:
HTTP Toolkit just signed up as the first sponsor! You can help support them too here:
Very much looking forward to the exciting new "Do-Not-Stab" HTTP header, glad to see somebody finally proposing serious solutions for this important issue:
RFC 35140: The Do-Not-Stab flag in the HTTP Header
Date: March 7, 2111 Abstract This document defines the syntax and semantics of the Do-Not-Stab header, a proposed HTTP header that allows users to indicate to a website their preferences about being…
www.5snb.club
November 27, 2024 at 3:01 PM
Very much looking forward to the exciting new "Do-Not-Stab" HTTP header, glad to see somebody finally proposing serious solutions for this important issue:
By popular request, there's a new HTTP Toolkit Black Friday deal!
Get 🎉 30% off 🎉 all HTTP Toolkit Pro annual subscriptions with coupon BLACKFRIDAY24 from now until next Tuesday (and that discount is recurring too, so it continues as long as your subscription does).
Get 🎉 30% off 🎉 all HTTP Toolkit Pro annual subscriptions with coupon BLACKFRIDAY24 from now until next Tuesday (and that discount is recurring too, so it continues as long as your subscription does).
November 25, 2024 at 3:40 PM
By popular request, there's a new HTTP Toolkit Black Friday deal!
Get 🎉 30% off 🎉 all HTTP Toolkit Pro annual subscriptions with coupon BLACKFRIDAY24 from now until next Tuesday (and that discount is recurring too, so it continues as long as your subscription does).
Get 🎉 30% off 🎉 all HTTP Toolkit Pro annual subscriptions with coupon BLACKFRIDAY24 from now until next Tuesday (and that discount is recurring too, so it continues as long as your subscription does).
Reposted by HTTP Toolkit
I wonder what percentage of all internet traffic is taken up by CORS preflight requests
November 12, 2024 at 5:41 PM
I wonder what percentage of all internet traffic is taken up by CORS preflight requests
HTTP Toolkit now has built-in support for Android TV interception! 📺
November 20, 2024 at 5:57 PM
HTTP Toolkit now has built-in support for Android TV interception! 📺