HTTP Monitor
ES

Extension for Chrome and Edge · version 2.3.0

Your app's traffic, open and under your control

HTTP Monitor watches a page's fetch and XMLHttpRequest calls and lets you step into them: mock a response, patch the one that came back, rewrite the request before it leaves, point it at a different server, or trigger the failure you can never reproduce by hand.

How to install it What it does with your data

Nothing you see leaves your browser

The extension has no server, no user account, and sends nothing anywhere. Rules, profiles and captured calls live in the browser's local storage and its internal database, on your machine. No analytics, no tracking, and not a single outbound request to the author.

The privacy policy spells it out permission by permission and field by field, including what the extension technically can see once you enable it on a site.

Three layers, depending on how deep you need to reach

An honest network debugger has to say where it is looking, because each vantage point sees different things. HTTP Monitor works at three, and you pick which one to use.

The three interception layers The page layer intercepts fetch and XHR inside the document. The network layer applies header, blocking and redirect rules to all of the tab's traffic. Deep mode uses the browser's debugger to reach the navigation itself, every subresource and the real response bodies, and is switched on per tab. Page layer the document's fetch and XMLHttpRequest calls, plus SSE and WebSocket Mocks responses, applies templates and scripts, edits the request. This is the default. Network layer all of the tab's traffic, workers and cross-origin frames included Headers, domain blocking and base-URL redirects. It cannot see bodies. Deep mode YOU TURN IT ON the navigation, every subresource and the real response bodies Uses the browser's debugger, per tab, and the browser says so while it is attached.
Top to bottom, each layer reaches further and costs more. The page layer is what you use 99% of the time; the third one is there for the 1% that cannot be solved any other way, and only when you switch it on — why it needs the debugger permission.

What you can do

Responses

Mock or patch

Return a body you wrote without calling the server, or let the server answer and change a single field of the real JSON. Several named responses per rule, so going from a 200 to a 500 is one click.

Requests

Edit before they leave

Method, URL, query parameters, headers and body. Useful for finding out what your app does when the token has expired or a required field is missing.

Network

Simulate conditions

Added latency, timeouts and going offline, applied to real calls, so you can finally see the loading states that never show up on your machine.

Captures

Inspect in detail

Headers as sent and as received, bodies in a JSON viewer, the call's lifecycle drawn out, the token decoded, and a diff between any two calls.

Insights

Audit the session

Duplicate calls, identical responses, broken caching, secrets in the query string, personal data in bodies, and fields that change shape between calls.

Portability

Export and import

HAR files both ways, Postman collections and the full configuration, so a scenario can travel to whoever has to reproduce it.

The permissions, without the small print

An extension that intercepts traffic asks for broad permissions, and that deserves an explanation before you install it rather than after. Here is the full list and what each one is for.

No permission is used to collect information
Permission What for
Access to the sites you visit Intercepting calls on the pages where you choose to work. You set the scope in the settings, and out of the box it is restricted: until you add a site, the extension acts on none.
Storage Keeping your rules, profiles and settings, and each tab's captures. All on your machine.
Tabs Knowing which tab you are looking at, so it shows that tab's captures and not another's.
Side panel Opening the interface when you click the icon.
Network rules and request observation Applying headers, blocks and redirects, and reading the real headers that went over the wire.
Script injection Showing the floating panel that tells you, on the page itself, which calls the extension is affecting.
Debugger Deep mode only, which you switch on tab by tab. It is the only way a browser hands over the real body of a response, and while it is attached Chrome shows its own notice that the tab is being debugged. The full argument.
Clipboard Copying a capture, a header or a rule, and pasting a rule someone shared with you.

Who it is for

For anyone building against an API who needs to see what actually happens: the error case the backend has not implemented yet, the slow response that never occurs locally, the field that arrives differently in production. It is a development tool, and it is meant for your own applications or ones you are authorised to work on — that is in the terms, and it is not a formality.