tamper[box]

API & HTTP tools

Inspect requests and responses before changing a client or server. Convert a collection locally, test a CORS preflight, trace redirects or compare transport behavior. A successful server request does not establish what every browser will allow.

Choose a check

Start with the request format when moving between clients. For a browser-only failure, compare the origin and preflight headers with CORS Tester. Use Redirect Checker when the request lands on a different host or protocol; HTTP/3 & Compression Checker separates advertisements from direct probe measurements.

Tools in this collection

  • JWT Decoder & Verifier

    Runs in browser
    • Debug a rejected login token without sharing it with another service.
    • Getting 401s? Read the token's claims and expiry.
    • Unsure the signature is valid? Verify it with your key, locally.
    • Need an expired or tampered token for a test? Edit one.
    • Token from production? Decode it without sending it anywhere.

    Decode JWT claims, verify signatures and edit test tokens locally.

    • Moving away from Postman? Take your requests with you.
    • Need API docs? Turn a Postman collection into OpenAPI.
    • Sharing a request in a ticket? Export it as cURL.
    • Have an OpenAPI spec? Import it as a Postman collection.
    • Moving specs between YAML and JSON along the way.

    Convert Postman collections to OpenAPI or cURL, and back.

  • Redirect Checker

    Runs on server
    • A link lands somewhere unexpected? Follow the detour.
    • Redirect loop? See the exact hop where it repeats.
    • Moved a page? Check it answers 301, not 302.
    • HTTP to HTTPS not working? Follow each step of the chain.
    • Slow first load? See the time spent on every hop.

    Follow a URL through every redirect: status codes, what changed and time per hop.

    • Is your site missing out on faster page delivery?
    • Turned on HTTP/3? Check the server advertises it with Alt-Svc.
    • Pages heavier than expected? See whether Brotli or zstd is served.
    • Applying for HSTS preload? Check the site is ready.
    • Compare which compression your server offers for a page.

    Check HTTP/3 support, Brotli, zstd and gzip compression, and HSTS preload readiness.

  • CORS Tester

    Runs on server
    • The request works outside the browser. Find out why the browser might refuse it.
    • Seeing "blocked by CORS policy"? Replay the preflight step by step.
    • Credentials not sent? Check Allow-Credentials against the origin.
    • Custom header rejected? See which Allow-Headers the server returns.
    • Works in curl, fails in the app? Compare what the browser checks.

    Send a CORS preflight and see step by step whether a browser would allow the request.

  • HAR File Sanitizer

    Runs in browser
    • Need to share a browser trace for a bug report? Review and redact it first.
    • Support asked for a HAR file? Strip tokens and cookies first.
    • Trace contains emails or names? Redact personal data.
    • Long capture? List only the requests that failed.
    • Check what is left in a HAR before you attach it to a ticket.

    Strip secrets and personal data from a HAR file and list its failed requests.

  • HAR to Mocks

    Runs in browser
    • Turn captured responses into test fixtures.
    • Flaky backend in tests? Replay captured responses with MSW.
    • Need a stub server? Export WireMock mappings from a HAR.
    • Writing Playwright tests? Generate routeFromHAR setup.
    • API behaviour changed? Compare two captures side by side.

    Export MSW or WireMock fixtures, create Playwright setup, or compare captures.

    • Generate invalid request bodies from schemas.
    • Have a JSON Schema? Generate bodies your API must reject.
    • Testing validation? Get one invalid case per rule.
    • Boundary values near min and max, generated from the schema.
    • Starting from OpenAPI? Build invalid requests for an endpoint.

    Create verified-invalid cases for a supported JSON Schema or OpenAPI subset.

    • Explain cookie scope and cache reuse rules.
    • Cookie missing on a subdomain? Check its Domain and Path scope.
    • Login cookie dropped in an iframe? Check SameSite and Partitioned.
    • Logged-in page served to someone else? Check Cache-Control and Vary.
    • Header too large? See the size of every cookie a page sets.

    Explain every cookie a page sets and its cache policy: scope, lifetime, size, risks.