HTTP Toolkit

Wouldn't it be nice if HTTP compression suddenly got 90% better for a whole bunch of common web scenarios?

Dictionary Compression is here to save the day: https://httptoolkit.com/blog/dictionary-compression-performance-zstd-brotli/
https://httptoolkit.com/blog/dictionary-compression-performance-zstd-brotli/

HTTP Toolkit can now automatically detect, parse & expose the EXIF metadata within intercepted images.

Quickly inspect the secret metadata in images to understand when, where, and how they were captured, and plenty more; EXIF can hide a surprising amount! https://en.wikipedia.org/wiki/Exif

Another year of paying #opensource maintainers for their hard work 🦾 alongside the rest of the https://opensourcepledge.com businesses, and to celebrate: we're back up on the NASDAQ tower in Times Square!

Vitor Daniel reverse engineered & probed his university's mobile app API with HTTP Toolkit, discovered a vulnerable endpoint leaking private data, and successfully worked with them to patch the issue and secure the service.

Great to see reverse engineering improving security like this, take a look at his write-up for the full story: https://vitordaniel.is-a.dev/blog/como-eu-encontrei-uma-vulnerabilidade-no-sistema-da-minha-universidade
https://vitordaniel.is-a.dev/blog/como-eu-encontrei-uma-vulnerabilidade-no-sistema-da-minha-universidade

Big milestone: HTTP Toolkit just crossed one million downloads! 🚀

Honestly I didn't think it'd ever get this far, I'm blown away. A huge thanks to all the users, contributors & supporters over the years ❤️. Onwards!

The best feature requests are the ones where the feature is already live 😀 https://github.com/httptoolkit/httptoolkit/issues/805

Did you know you can breakpoint requests & responses in live traffic with HTTP Toolkit, to modify them, inject a response or simulate errors?
https://github.com/httptoolkit/httptoolkit/issues/805

Interested in how rate limiting can work to throttle HTTP clients effectively? @fanf@mendeddrum.org has written some fascinating thoughts about the (relatively) new HTTP standard Rate Limit Header: https://dotat.at/@/2026-01-13-http-ratelimit.html
https://dotat.at/@/2026-01-13-http-ratelimit.html

Interested in debugging terminal & Docker network traffic with HTTP Toolkit?

Take a skim through this quick intro from Learn Code Camp to get started: https://learncodecamp.net/terminal-http-intercept/
https://learncodecamp.net/terminal-http-intercept/#powerful-inspection-tools

Multi-step HTTP rules are now live! 🪜

As the first new steps, you can now add custom delays during processing to simulate latency, and attach request and/or response webhooks to rules to fire data out from HTTP Toolkit for matched traffic. More to come soon!

Have ideas about other multi-step rules you'd like to see? Get in touch: https://github.com/httptoolkit/httptoolkit/issues/new/choose

Reverse engineering can be intimidating, but modern tools are fantastic, and it's honestly easier than it sounds to get started digging into app's internals and changing their their behaviour.

Take a look at the HTTP Toolkit guide for a quick intro: https://httptoolkit.com/blog/android-reverse-engineering/
https://httptoolkit.com/blog/android-reverse-engineering/

Want to dig into traffic byte-by-byte, to read your TLS handshakes and TCP packets directly?

With the new support for keylog files in the Pro settings, you can now integrate HTTP Toolkit into tools like Wireshark 🦈

That means you can use HTTP Toolkit to easily capture, read & modify HTTP at the application level, and simultaneously examine the underlying packets at the same time, with automatic decryption so you can see everything (like which TLS handshake is which 403 response).

Need a second opinion understanding your HTTP, or a quick first pass to find the good bits?

HTTP Toolkit now has MCP support!

Copy-paste setup for Claude Code and plenty more, so it just takes seconds to get your LLMs intercepting & inspecting HTTP all by themselves ✨