Intercept, inspect & replay every request.
HTTrail is a native HTTPS debugging proxy and API client in one app. Decrypt your own TLS with an on-device certificate authority, capture every flow, then compose or replay — without a single byte leaving your machine.
Universal build for Apple Silicon & Intel · macOS 14+ · also coming to the App Store
Native, not Electron
Pure Swift + SwiftUI on a SwiftNIO core. It starts instantly, sips memory, and feels like a Mac app because it is one.
Local by design
The proxy, the CA, your captured flows, and replay history all live on your machine. There is no HTTrail server to send anything to.
Yours to trust
The root CA's private key is generated on-device and never leaves it. You install it, you trust it, you remove it — entirely under your control.
// Capabilities
A whole debugging toolkit in one window.
Two products, fused: a Charles-style intercepting proxy and a Hoppscotch-style API client, sharing one capture engine.
HTTPS MITM proxy
Answers CONNECT, terminates TLS with a freshly minted leaf cert, forwards to the real origin, and captures both directions — live-tested against real hosts.
On-device certificate authority
Generates a self-signed P-256 root (10-year, persisted) and mints per-host leaf certs on the fly. One-click install & trust on macOS.
Charles-style rules engine
Block, map local, map remote, rewrite request or response, throttle bandwidth, and set interactive breakpoints — pause a flow, edit the body, continue.
Deep flow inspector
Headers, raw and pretty-printed JSON bodies, live HTML preview, image preview, plus status, timing, and size for every captured flow.
Request composer
Methods, query params, headers, every body mode, GraphQL, and {{env}} variables — with Bearer, Basic, and API-key auth helpers built in.
Realtime clients
WebSocket, Server-Sent Events, Socket.IO (Engine.IO v4 handshake), and an MQTT 3.1.1 client — all over the same NIO core.
Import & export
Bring in cURL, OpenAPI 3, and Postman v2.1. Send out cURL, Swift, JavaScript, or Python — and export captured flows as HAR 1.2.
Pre-request & test scripts
Run JavaScript before and after a request through JavaScriptCore, with a familiar pm.* API for assertions and dynamic values.
SSL-proxying allowlist
Only decrypt the hosts you list. Everything else is blind-tunnelled untouched, so certificate-pinned apps keep working alongside your capture.
// Four steps
From zero to decrypted traffic.
Start the proxy
Hit the toolbar play button or ⌘P. HTTrail listens on 127.0.0.1:9090.
Trust the CA
One click installs & trusts the root CA on macOS — or install the .mobileconfig profile on iOS.
Capture
Toggle the system proxy and every request & response streams into the Capture tab in real time.
Compose & replay
Edit-and-resend any flow, copy it as cURL, or build a fresh request and hit Send (⌘↵).
// One core, two platforms
Built for Mac and iPhone.
The capture engine, CA, and app model are shared in a single Swift core, so both apps stay in lockstep.
macOS
The full debugger, with native system integration.
- System-proxy toggle via
networksetup - One-click CA install & trust into the System keychain
- Reveal & export the root CA from Finder
- Full inspector, composer, rules, and realtime clients
iOS
Capture this iPhone, or another device through your Mac.
- On-device capture VPN via a Packet Tunnel extension
- Capture keeps running while the app is backgrounded
- Installs CA + proxy through a single
.mobileconfig - Or point any device's proxy at your Mac — no dev account needed
Your traffic never leaves your device.
HTTrail has no analytics, no accounts, and no backend. The data it decrypts is the most sensitive you have — tokens, cookies, request bodies — so it stays entirely on your machine, and we built it so we can never receive it.