200ms in the life of an HTTP request: 200ms.thenodebook.com/

An interactive visualization that follows a single HTTP request through its entire ~200ms life — DNS, TCP, TLS, the kernel, Node's event loop, Postgres, and back

Scroll through the complete life of one HTTP request in real time — from a click in a coffee shop through DNS, TCP, TLS, the kernel, Node's event loop, and Postgres, back to the pixel. Time only passes when you move. 211 ms.

200ms.thenodebook.com

Coming soon to an HTTP Toolkit near you...

Tim Perry@pimterry.fyi · 4w ago

Nearly 5 years of work later, I've successfully closed the Node.js TLS fingerprinting issue: github.com/nodejs/node/.... As of Node 26.4.0, it's possible to match most common TLS fingerprints in Node directly. I've published a library to do all the hard work here: github.com/httptoolkit/...

Have you seen testserver.host/? As part of building HTTP Toolkit I often need a remote servers for testing edge cases, so I've built one! Now fairly mature & stable. It's httpbin.org plus badssl.com plus lots of extras.

Oh. After many long years... HTTP now officially has a standard QUERY method. Think: cacheable, idempotent GET that can carry a meaningful payload. We can now all stop bastardizing POST. auth48-transition.rfc-editor.org/authors/rfc1...

Ever wish HTTP status codes were easier to remember? 🖼️ Check out this MDN cheatsheet that pairs each status code with an emoji to help you visualize what each one means, from 200 OK ✅ to 418 I’m a teapot 🫖 Check it out 👇

HTTP Toolkit can now automatically detect, parse & expose the EXIF metadata within intercepted images. Quickly inspect the secret metadata in images to understand when, where, and how they were captured, and plenty more; EXIF can hide a surprising amount! en.wikipedia.org/wiki/Exif

Need a second opinion understanding your HTTP, or a quick first pass to find the good bits? HTTP Toolkit now has MCP support! Copy-paste setup for Claude Code and plenty more, so it just takes seconds to get your LLMs intercepting & inspecting HTTP all by themselves ✨

I've been thinking about simonomi.dev/blog/color-c.... Whipped up a quick prototype for HTTP Toolkit's hex view - what do you think? Interesting and more useful than monochrome, or just visually noisy? See if you can guess what each file type is here - answers in the alt text 😀

The proxy inside HTTP Toolkit (github.com/httptoolkit/...) was just updated: 30%+ more throughput, lower latency, and perfect mirroring for WebSockets too. Live now in Mockttp for custom proxies, coming to an HTTP Toolkit near you later this week!

Wouldn't it be nice if HTTP compression suddenly got 90% better for a whole bunch of common web scenarios? Dictionary Compression is here to save the day: httptoolkit.com/blog/diction...

Dictionary Compression is finally here, and it's ridiculously good

Dictionary compression could completely change how applications send data over the web. It's recently gained broad support, and offers absurd real-world...

httptoolkit.com

Vitor Daniel reverse engineered & probed his university's mobile app API with HTTP Toolkit, discovered a vulnerable endpoint leaking private data, and successfully worked with them to patch the issue and secure the service. Great write-up! vitordaniel.is-a.dev/blog/como-eu...

Hackeei minha universidade e obtive acesso aos dados de todos os alunos

Um relato pessoal sobre como descobri e reportei uma vulnerabilidade crítica de segurança no sistema da UFRN

vitordaniel.is-a.dev

It's hard to find the needle in the haystack sometimes... You can now right-click any request in HTTP Toolkit to use its hostname as a filter, to quickly hide any host or show it exclusively, in one click right from the traffic itself 🪡

Interested in how rate limiting can work to throttle HTTP clients effectively? Tony Finch has written some fascinating thoughts about the (relatively) new HTTP standard Rate Limit Header: dotat.at/@/2026-01-13...

HTTP RateLimit headers – Tony Finch

There is an IETF draft that aims to standardize RateLimit header fields for HTTP. A RateLimit header in a successful response can inform a client when it might expect to be throttled, so it can avoid 429 Too Many Requests errors. Servers can also include RateLimit headers in a 429 response to make the error more informative.

dotat.at

Interested in debugging terminal & Docker network traffic with HTTP Toolkit? Take a skim through this quick intro from Learn Code Camp to get started: learncodecamp.net/terminal-htt...

Debugging HTTP Traffic Like a Pro: HTTP Toolkit and Terminal Interception - Learn Code Camp

Debug HTTP traffic from your terminal with HTTP Toolkit. One-click interception for git, npm, curl & more. See exactly what CLI tools send and receive.

learncodecamp.net

It's that time of year again, and so as the prophecy foretold, there must be a new HTTP Toolkit Black Friday deal 💸 This year it's **50% off forever** on all HTTP Toolkit Pro annual subscriptions, from now till Tuesday, with code BLACKFRIDAY25. Happy Thanksgiving/shopping week!

Big milestone: HTTP Toolkit just crossed one million downloads! 🚀 Honestly I didn't think it'd ever get this far, I'm blown away. A huge thanks to all the users, contributors & supporters over the years ❤️. Onwards!

If you like turning HTTP into code, you'll be excited to hear that HTTP Toolkit can now export requests as ready-to-use code for: - Rust's Reqwest library - Ruby's Faraday library - Crystal's built-in APIs - Spring RestClient on the JVM Plus plenty of other fixes & tweaks to improve other cases.

Want to quickly get a curl request into HTTP Toolkit's Send tool, to start tweaking & testing parameters? If you paste curl commands directly into the Send page URL bar, it'll now automatically parse it and fill out all the fields for you ✨

The best feature requests are the ones where the feature is already live 😀 github.com/httptoolkit/... Did you know you can breakpoint requests & responses in live traffic with HTTP Toolkit, to modify them, inject a response or simulate errors?

Add breakpoint-style debugging for app traffic · Issue #805 · httptoolkit/httptoolkit

It would be amazing if HTTP Toolkit could include a feature similar to browser DevTools breakpoints, but for app network requests. Right now, HTTP Toolkit lets you intercept, view, and mock request...

github.com

Multi-step HTTP rules are now live! 🪜 As the first new steps, you can now add custom delays during processing to simulate latency, and attach request and/or response webhooks to rules to fire data out from HTTP Toolkit for matched traffic. More to come soon!

Another year of paying #opensource maintainers for their hard work 🦾 alongside the rest of the OpenSourcePledge.com businesses, and to celebrate: we're back up on the NASDAQ tower in Times Square!

Reverse engineering can be intimidating, but modern tools are fantastic, and it's honestly easier than it sounds to get started digging into app's internals and changing their their behaviour. Take a look at the HTTP Toolkit guide for a quick intro: httptoolkit.com/blog/android...

Reverse engineering & modifying Android apps with JADX & Frida

I get a lot of emails from users who want to know exactly what their favourite Android app is doing, and want to tweak and change how that works for...

httptoolkit.com

Want to dig into traffic byte-by-byte, to read your TLS handshakes and TCP packets directly? With the new support for keylog files in the Pro settings, you can now integrate HTTP Toolkit into tools like Wireshark 🦈

¡Enhorabuena a @httptoolkit.com por obtener el Sello Ayuda Efectiva como empresa de alto impacto! La empresa ha donado al menos un 0,7% de sus ingresos a los programas benéficos más efectivos. 🏅 Página de certificación e impacto: ayudaefectiva.org/empresa/http...

Redirecting traffic? HTTP Toolkit transform rules just gained a long list of new options, including arbitrary regex match & replace logic, precisely targeted for every URL component - fully combinable with all the other existing request & response transforms.

I've been doing some ridiculously neat reverse engineering recently. Check this out: github.com/httptoolkit/... That code is modifying functions inside Flutter apps, without debug info, by *fingerprinting known chunks of assembly* for each CPU architecture, and then scanning memory to find them 🤯

Want to script your own MitM proxy? You can use HTTP Toolkit's internals standalone via Mockttp, a JS library to build HTTP, WebSocket & TLS intercepting proxies: github.com/httptoolkit/... v4 just went live: advanced URL regex rewriting, delay mixins, and non-HTTP proxying too 🚀

GitHub - httptoolkit/mockttp: Powerful friendly HTTP mock server & proxy library

Powerful friendly HTTP mock server & proxy library - httptoolkit/mockttp

github.com

Having a rooted android device with man-in-the-middle http capture using #httpToolkit is so much fun. It's crazy how much evil shit the apps are up to 🤯 https://httptoolkit.com/ ALWAYS use the website instead of the app if possible. #android #infosec

Intercept, debug & build with HTTP

Beautiful, cross-platform & open-source tools for debugging, testing and building with HTTP(S), on Windows, Linux & Mac.

httptoolkit.com

It's been a long time coming but the http QUERY method spec is nearly done www.ietf.org/archive/id/d...

Some major performance updates have gone live this week 🚀 With a big internal redesign, memory usage just dropped 40%, and processing input got up to 50x (!) faster. A nice drop in CPU while intercepting, but a huge boost when you load a HAR of 100s of thousands of requests.