AwesomeREA.org

Tool

HTTP Toolkit

Open-source HTTP(S) debugging proxy for Windows, Linux and macOS that sets up interception for browsers, terminals, backend runtimes, Electron apps and Android devices, then shows the full headers and body of every request and response with body decoding, inline header documentation and filtering. Its transparent proxy handles plain HTTP, HTTPS, HTTP/2 and WebSockets on one port; breakpoints rewrite live requests or responses, and a built-in client sends custom requests. This repository is the project's umbrella README and issue tracker, while the UI, server, Mockttp proxy library, Android app and desktop shell live in sibling repositories.

Targets
App · Protocol · Website
Category
Website analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • At the reviewed commit this umbrella repository holds only the README, a security policy and a demo animation, and serves as the project's issue tracker. The product is built from sibling repositories: httptoolkit-ui (TypeScript and React), httptoolkit-server (Node.js, whose interceptor list covers Chromium-based browsers, Firefox, terminals, Electron, Android over ADB, Frida on Android and iOS, JVM processes and Docker containers), the Mockttp proxy library, the Android app and the Electron desktop shell; only their READMEs and the server's interceptor list were reviewed.
  • Latest desktop release at review: v1.27.3, published 2026-10-20, with a Windows installer and zip, macOS x64 and arm64 DMGs and Linux x64 and arm64 AppImage, deb, rpm and zip builds. The desktop shell bundles the server and opens the UI in Electron; the server can also run standalone as a CLI with the hosted web UI opened in a browser, and both update themselves separately from the desktop executable.
  • HTTPS inspection needs the client to trust HTTP Toolkit's CA certificate: interceptors launch preconfigured browsers, terminals and apps, and the server's certificate check downloads or installs the certificate where it is not yet trusted. The Android app trusts the certificate and forwards device traffic through a local VPN; its README says a rooted device is not required but widens the real app traffic that can be tested. Inspect only traffic from your own clients and devices or ones you are authorized to test.
  • The pricing page lists interception of all supported clients, raw inspection, filtering, manual rewriting and manual requests in the free Hobbyist tier, while mock rules and automatic transforms, edit-and-resend, rule and traffic import/export (including HAR), API validation and advanced proxy settings such as TLS passthrough and upstream proxies need a paid Pro account. The README describes the HTTP Toolkit-specific components as AGPL-3.0 and the reusable libraries as Apache-2.0 or MIT; this repository has no license file, and the desktop README offers its binaries under AGPL-3.0 or CC BY-ND 4.0. No traffic was intercepted.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · httptoolkit/httptoolkit · Revision bb579a8
  2. README.md#L28-L40 GitHub · httptoolkit/httptoolkit · Revision bb579a8
  3. README.md#L64-L79 GitHub · httptoolkit/httptoolkit · Revision bb579a8
  4. https://github.com/httptoolkit/httptoolkit/tree/bb579a8ceadfe86b98160843c0447a5b9eec554f
  5. README.md GitHub · httptoolkit/httptoolkit-server · Revision 3973d10
  6. src/interceptors/index.ts GitHub · httptoolkit/httptoolkit-server · Revision 3973d10
  7. README.md GitHub · httptoolkit/httptoolkit-desktop · Revision 71c10c7
  8. README.md GitHub · httptoolkit/httptoolkit-android · Revision 53d7e35
  9. https://github.com/httptoolkit/httptoolkit-desktop/releases/tag/v1.27.3
  10. https://httptoolkit.com/get-pro/

More in Websites

All 48 entries in Websites