If you're using custom system CAs on Android for TLS - whether that's for HTTPS debugging, ad blocking or local testing - there's trouble brewing. Let's talk about the latest Android 17 changes and how to keep things working: httptoolkit.com/blog/android…

Wow - @daoud_youssef has just put out 5 (five!) separate intro videos for all sorts of different HTTP Toolkit use cases on YouTube. If you want some help getting started, take a look: youtube.com/@daoudyoussef799… youtube.com/watch?v=vgQAkh9B…

200ms in the life of an HTTP request: 200ms.thenodebook.com/ 200ms.thenodebook.com/

Automatic support for this coming soon to an HTTP Toolkit near you...

Nearly 5 years of hard work later, the TLS fingerprinting Node.js issue is finally fixed: github.com/nodejs/node/issue…. It's now possible to match most common TLS fingerprints directly in Node.js! There's a new library to do all the hard work here: github.com/httptoolkit/node-…

All free & open source. Visit the root page at testserver.host to see the full docs, or check out github.com/httptoolkit/tests… for the source and self-hosting instructions. testserver.host

(For extra fun, refresh the HTTP/2 page to see HTTP header compression in action: on my machine, the HEADERS frame drops from 499 bytes to 27 by magic)

Ever wonder what HTTP/1 and HTTP/2 data looks like for the exact same request? http1.testserver.host/echo http2.testserver.host/echo HTTP/1 is a raw string, HTTP/2 includes parsed JSON per frame, with the raw data in the `payload_hex` field. http2.testserver.host/echo

Or combine them! revoked--tls-v1-2.testserver… A websocket server that only supports TLS v1.2 and uses a revoked certificate - once you connect, it sends hello, then sends goodbye, then closes the connection. revoked.testserver.host/dela…

Chainable endpoints? HTTP: testserver.host/info/123/del… - return a 123 intermediate status, wait 1 second, then return a 404 TLS: incomplete-chain--expired--h…: give me an expired cert, missing the intermediate cert in the chain, and exclusively negotiate HTTP/2. testserver.host/info/123/del…

End result: on my local machine & wifi, curl -kv expired.badssl.com/ takes more than a second, and httpbin.org/anything takes 2.2s. expired.testserver.host/anyt… takes about 150ms 🚀 httpbin.org/anything

Faster & more reliable? 1. Horizontal autoscaling & globally distributed: low latency everywhere, failover, easy to scale. 2. Cert issuance 100% automated, with ACME and a local CA (many badssl cases need manual setup, and so rot: failing due to expiry, not the real cause).

Extras you say? * More endpoints, like /echo (echoes back raw HTTP), /encoding/zstd, and /error/reset * Websocket support * Faster & more reliable than either * Combining HTTP & TLS tests (give me an expired cert, then a 404 response) * Chainable endpoints, for both HTTP & TLS

Have you seen testserver.host/? As part of building HTTP Toolkit I often need a remote servers for testing edge cases, so I've built one! Now fairly mature & stable. It's httpbin.org plus badssl.com plus lots of extras. testserver.host/

HTTP Toolkit can now automatically detect, parse & expose the EXIF metadata within intercepted images. Quickly inspect the secret metadata in images to understand when, where, and how they were captured, and plenty more; EXIF can hide a surprising amount! en.wikipedia.org/wiki/Exif

Need a second opinion understanding your HTTP, or a quick first pass to find the good bits? HTTP Toolkit now has MCP support! Copy-paste setup for Claude Code and plenty more, so it just takes seconds to get your LLMs intercepting & inspecting HTTP all by themselves ✨

What's perfect mirroring? Before, WebSockets were negotiated separately up & down stream. The data was the same but some handshake params could differ. We now take full low-level control of negotiation and link the two directly instead, to perfectly clone the full socket 👯

The proxy inside HTTP Toolkit (github.com/httptoolkit/mockt…) was just updated: 30%+ more throughput, lower latency, and perfect mirroring for WebSockets too. Live now in Mockttp for custom proxies, coming to an HTTP Toolkit near you later this week!

Wouldn't it be nice if HTTP compression suddenly got 90% better for a whole bunch of common web scenarios? Dictionary Compression is here to save the day: httptoolkit.com/blog/diction… httptoolkit.com/blog/diction…

Vitor Daniel reverse engineered & probed his university's mobile app API with HTTP Toolkit, found a vulnerable endpoint leaking private data, and successfully worked with them to patch the issue. Great write-up! vitordaniel.is-a.dev/blog/co… vitordaniel.is-a.dev/blog/co…