# API & HTTP tools

Inspect requests and responses before changing a client or server.

Canonical: https://tamperbox.dev/categories/api

Updated: 2026-10-29

Reviewed: 2026-10-26

Inspect requests and responses before changing a client or server. Convert a collection locally, test a CORS preflight, trace redirects or compare transport behavior. A successful server request does not establish what every browser will allow.

## Choose a check

Start with the request format when moving between clients. For a browser-only failure, compare the origin and preflight headers with CORS Tester. Use Redirect Checker when the request lands on a different host or protocol; HTTP/3 & Compression Checker separates advertisements from direct probe measurements.

## Tools in this collection

- [JWT Decoder & Verifier](https://tamperbox.dev/jwt): **Debug a rejected login token without sharing it with another service.**

  Decode JWT claims, verify signatures and edit test tokens locally.
- [Postman Collection Converter](https://tamperbox.dev/postman-converter): **Moving away from Postman? Take your requests with you.**

  Convert Postman collections to OpenAPI or cURL, and back.
- [Redirect Checker](https://tamperbox.dev/redirect-checker): **A link lands somewhere unexpected? Follow the detour.**

  Follow a URL through every redirect: status codes, what changed and time per hop.
- [HTTP/3 & Compression Checker](https://tamperbox.dev/http3-checker): **Is your site missing out on faster page delivery?**

  Check HTTP/3 support, Brotli, zstd and gzip compression, and HSTS preload readiness.
- [CORS Tester](https://tamperbox.dev/cors-tester): **The request works outside the browser. Find out why the browser might refuse it.**

  Send a CORS preflight and see step by step whether a browser would allow the request.
- [HAR File Sanitizer](https://tamperbox.dev/har-sanitizer): **Need to share a browser trace for a bug report? Review and redact it first.**

  Strip secrets and personal data from a HAR file and list its failed requests.
- [HAR to Mocks](https://tamperbox.dev/har-to-mocks): **Turn captured responses into test fixtures.**

  Export MSW or WireMock fixtures, create Playwright setup, or compare captures.
- [Negative Payload Generator](https://tamperbox.dev/negative-payload-generator): **Generate invalid request bodies from schemas.**

  Create verified-invalid cases for a supported JSON Schema or OpenAPI subset.
- [Cookie Header Explainer](https://tamperbox.dev/cookie-header-explainer): **Explain cookie scope and cache reuse rules.**

  Inspect Set-Cookie, Cache-Control, Vary and ETag without sending requests.

## Continue exploring

[Email authentication tools](https://tamperbox.dev/categories/email) · [Domains, registration & hosting tools](https://tamperbox.dev/categories/domains) · [DNS tools](https://tamperbox.dev/categories/dns) · [Network & IP tools](https://tamperbox.dev/categories/network) · [Crawl, SEO & site checks](https://tamperbox.dev/categories/web) · [Web security & TLS tools](https://tamperbox.dev/categories/security) · [Data format tools](https://tamperbox.dev/categories/data) · [Text & test data tools](https://tamperbox.dev/categories/text-testdata) · [Localization tools](https://tamperbox.dev/categories/localization) · [UI testing tools](https://tamperbox.dev/categories/ui-testing)