HTTP Request Tester (Online cURL)
โ ๏ธ Anti-SSRF: requests to local/private networks (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x) are blocked.
How to use the HTTP request tester
- Enter the full URL including
https://and choose the HTTP method. - Add request headers one per line, e.g.
Content-Type: application/jsonorAuthorization: Bearer โฆ. - For POST, PUT and PATCH put the raw request body in Payload โ JSON, form data or plain text.
- Optionally fill in Basic Auth credentials, then click Send request (or Ctrl/โ+Enter).
- Inspect the status line, response headers, body and timings: DNS lookup, connect and time to first byte.
The equivalent cURL command for a JSON POST would be:
curl -X POST -H 'Content-Type: application/json' -d '{"hello":"world"}' https://api.example.com/endpoint
HTTP status codes at a glance
| Code | Meaning |
|---|---|
| 200 / 201 / 204 | OK / Created / No Content |
| 301 / 302 / 307 / 308 | Redirects โ followed automatically (up to 5) |
| 304 | Not Modified (cached version is still valid) |
| 400 | Bad Request โ malformed syntax or body |
| 401 / 403 | Unauthorized (missing or invalid credentials) / Forbidden |
| 404 / 405 | Not Found / Method Not Allowed |
| 429 | Too Many Requests โ rate limited |
| 500 / 502 / 503 / 504 | Server error / Bad Gateway / Service Unavailable / Gateway Timeout |
Limits
- 50 requests per 24 hours per IP address.
- Requests to private, local and reserved networks (localhost, 10.x, 192.168.x, cloud metadata) are blocked, including via redirects.
- Timeout 20 seconds; response bodies over 200 KB are truncated; request bodies are limited to 100 KB.
Frequently asked questions
Why use an online HTTP tester instead of the browser?
Requests are sent from our server, so browser CORS restrictions do not apply and you can set any method, headers and body โ similar to cURL or Postman, without installing anything.
Why canโt I test localhost or my local network?
For security (SSRF protection) the tester only reaches public internet addresses. To test local services, use cURL on your machine.
Are my requests or credentials stored?
No. The request and response are passed through and not logged. Only a per-IP counter is kept for 24 hours for rate limiting. Avoid sending production secrets to any third-party tool.
Does it follow redirects?
Yes, up to 5 redirects. Each redirect target is checked with the same security rules, and Basic Auth is only sent to the original host.
What does โAllow insecure SSLโ do?
It skips TLS certificate verification, which is useful for hosts with self-signed or expired certificates. Do not rely on it for sensitive data.