HTTP Toolkit

Automatic support for this coming soon to an HTTP Toolkit near you...

Nearly 5 years of hard work later, the TLS fingerprinting Node.js issue is finally fixed: github.com/nodejs/node/is…. It's now possible to match most common TLS fingerprints directly in Node.js! There's a new library to do all the hard work here: github.com/httptoolkit/no…

All free & open source. Visit the root page at testserver.host to see the full docs, or check out github.com/httptoolkit/te… for the source and self-hosting instructions. testserver.host

(For extra fun, refresh the HTTP/2 page to see HTTP header compression in action: on my machine, the HEADERS frame drops from 499 bytes to 27 by magic)

Have you seen testserver.host? As part of building HTTP Toolkit I often need a remote servers for testing edge cases, so I've built one! Now fairly mature & stable. It's httpbin.org plus badssl.com plus lots of extras. testserver.host

HTTP Toolkit can now automatically detect, parse & expose the EXIF metadata within intercepted images. Quickly inspect the secret metadata in images to understand when, where, and how they were captured, and plenty more; EXIF can hide a surprising amount! en.wikipedia.org/wiki/Exif

Need a second opinion understanding your HTTP, or a quick first pass to find the good bits? HTTP Toolkit now has MCP support! Copy-paste setup for Claude Code and plenty more, so it just takes seconds to get your LLMs intercepting & inspecting HTTP all by themselves ✨

What's perfect mirroring? Before, WebSockets were negotiated separately up & down stream. The data was the same but some handshake params could differ. We now take full low-level control of negotiation and link the two directly instead, to perfectly clone the full socket 👯

The proxy inside HTTP Toolkit (github.com/httptoolkit/mo…) was just updated: 30%+ more throughput, lower latency, and perfect mirroring for WebSockets too. Live now in Mockttp for custom proxies, coming to an HTTP Toolkit near you later this week!

Wouldn't it be nice if HTTP compression suddenly got 90% better for a whole bunch of common web scenarios? Dictionary Compression is here to save the day: httptoolkit.com/blog/dictionar… httptoolkit.com/blog/dictionar…

Vitor Daniel reverse engineered & probed his university's mobile app API with HTTP Toolkit, found a vulnerable endpoint leaking private data, and successfully worked with them to patch the issue. Great write-up! vitordaniel.is-a.dev/blog/como-eu-e… vitordaniel.is-a.dev/blog/como-eu-e…

@Rokkozz_ Global search is supported - in addition to the targeted filters (hostname=, header[x]*=y), you can use contains(x) to search every single field & the body for any string you like. Is that what you're looking for? Filtering docs are here: #filtering-intercepted-traffic" target="_blank" rel="nofollow noopener">httptoolkit.com/docs/reference…

@HttpToolkit Global search would be a nice featue

It's hard to find the needle in the haystack sometimes... You can now right-click any request in HTTP Toolkit to use its hostname as a filter, to quickly hide any host or show it exclusively, in one click right from the traffic itself 🪡

It'd be easy to add more one-click filters to this menu - any suggestions for what you'd like to be able to quickly add?