Interceptor - HTTP Proxy for Web Devs

Interceptor brings HTTP debugging, API testing, and browser security inspection into one workbench. See what your app sends, edit live requests and responses, reproduce API calls, and keep your testing work locally—without configuring a system proxy or installing extra certificates. Built for web developers and security testers working on applications they own or are authorized to test. INSPECT, EDIT, AND REPLAY • Intercept: pause live requests and responses. Edit the method, URL, headers, or text body, then forward, drop, or catch the response after forwarding. • HTTP History: search captured traffic by URL, headers, or body. Filter by method, status, and resource type; inspect timing and size; import and export HAR files. API requests sent from the workbench appear here too. • Repeater: edit and resend requests with custom headers, including Cookie and Origin. View the actual request sent, set timeouts, duplicate requests, and compare the last five response snapshots. • Auto mode: automatically rewrite selected fields in query strings, JSON, form bodies, and multipart text fields to test server-side validation. Choose this tab or all tabs, limit changes with URL include/exclude rules, and review the change log. BUILD REUSABLE API TESTS • API Builder: compose requests with JSON, form, or raw bodies and Bearer, Basic, or API key header authentication. • Collections and environments: organize requests in folders with names, notes, and saved assertions. Reuse {{variables}}, switch environments, and import supported cURL commands or Postman collections. • Response assertions: check status codes, headers, JSON Pointer values, body text, response time, and size in Builder, Repeater, and Runner. • Payload Runner: try up to 50 values sequentially against one origin. Use boundary presets, delays, timeouts, cancellation, per-response tests, CSV export, and response comparison. UNDERSTAND YOUR APP'S TRAFFIC • Site Map: group recorded endpoints by origin, method, and path, with call counts, statuses, timings, and query fields. • Inspector: examine repeated query/form fields, exact JSON numeric values, cookies, response headers, and cookie attributes. • Comparer: compare responses or text side by side, normalize JSON formatting, and copy unified diffs. • Decoder: transform JSON, URL encoding, Base64, hex, and HTML entities; inspect JWT headers and payloads; calculate SHA-256 and SHA-512 hashes. JWT inspection does not verify signatures. REVIEW SECURITY EVIDENCE • Security Review: passively review captured security headers, CORS, CSP, framing restrictions, cookie flags, caching, transport, credential-like URL fields, and detailed error responses. Mark observations reviewed or ignored and export reports. • Credential comparison: compare responses to two GET, HEAD, or OPTIONS requests with and without credential headers, using one origin and no redirects. Query and body credentials remain unchanged. • WebSockets: inspect sent and received text or binary frame previews from the attached tab. Filter messages, send payloads to Decoder, and export frames. Frame inspection is passive. SAVE YOUR WORK AND YOUR LAYOUT History, requests, responses, snapshots, collections, environments, tool drafts, test results, observations, and frames save automatically in your browser profile on your PC. Download a full workspace backup and import it with validation, a restore preview, and undo. Add a password to encrypt the backup. Full backups include stored credentials; backup passwords are never saved. Restoring sends no requests and leaves Auto mode off. Resize split tools with 15 draggable dividers. Pane sizes stay saved for wide and stacked layouts and are included in full backups. Keyboard resizing, reset controls, dark/light themes, and Command/Ctrl shortcuts help you work comfortably. LOCAL PROCESSING, CLEAR CONTROLS No account, analytics, telemetry, cloud sync, or remotely loaded code. Analysis and storage run locally. Active request tools send traffic to the targets you choose. Imported cURL commands and Postman scripts are never executed. Security observations require context and manual verification. Site Map and Security Review use recorded traffic without crawling. History, response bodies, and frame previews have size limits; browser restrictions and local disk quotas apply. Free and open source under the MIT license. Documentation, support, and contributions: https://github.com/user-github-me/interceptor