HTTPS Capture Quick Start: Decrypt Your First HTTPS Request

HTTPS Capture is a packet sniffer that lives entirely on your iPhone. A local VPN tunnel routes device traffic through an on-device MITM proxy, so you can read every HTTP, HTTPS, DNS and WebSocket exchange without a computer, without a jailbreak, and without sending a byte of captured traffic off the device. This page takes you from a fresh install to your first decrypted request.

What you need

• An iPhone running iOS 17 or later
• About ten minutes — most of it spent in Apple’s Settings app, which the app guides you through
• Optional for full HTTPS decryption: permission to install a configuration profile on the device

If the device is managed by an organization (MDM), profile installation may be restricted — plain HTTP, DNS and connection-level capture still work without the certificate.

First launch

The first launch shows a three-page tour — the live capture list, the request inspector, and the request composer — followed by an optional upgrade screen if you are not a Pro subscriber. Close it and continue; capturing and inspecting traffic does not require a subscription.

The app opens with four tabs:

• Capture — the big start/stop button, live counters, the setup status for HTTPS decryption, the Rules entry point, and your recent sessions.
• Requests — a composer to build and send requests from scratch: import cURL, edit method, headers and body, or replay any captured request with changes.
• Toolbox — a growing set of standalone network utilities.
• Settings — capture options, certificate management, the upstream proxy, appearance and more.

Turn on HTTPS decryption (one-time setup)

Plain HTTP, DNS queries and raw TCP connections are visible right away. To read HTTPS bodies you need to complete a guided setup once: from the Capture tab, tap the MitM — HTTPS decryption row and follow the three steps. The screen shows a 0/3 progress ring and auto-refreshes as you complete each step.

1. Enable VPN — approve the VPN configuration iOS presents. This creates a local, on-device tunnel; no traffic leaves the phone because of it.
2. Install Certificate — tap Download Certificate Profile. Safari opens, downloads the CA profile, then go to Settings → General → VPN & Device Management and install the profile.
3. Trust Certificate — go to Settings → General → About → Certificate Trust Settings and toggle ON the certificate for HTTPS Capture. Without this step, clients refuse the decrypted connection.

The MitM row on the Capture tab turns green when everything is ready. Each CA only needs this once — but if you later regenerate or import a different CA, the steps must be repeated for the new certificate.

Tip: The default CA is generated per app install. For the strongest privacy posture, open the MitM page and use Regenerate CA to create a CA that only exists on your device, then install and trust that one.

Capture your first session

1. On the Capture tab, tap the start button. A session is created automatically and the live counters (requests, domains, upload/download, rate) start moving.
2. Switch to any other app or Safari and use it normally. HTTPS Capture records everything that goes through the tunnel — every request lands in the session list with method, status, host, path, size and duration.
3. Return to the app and tap the live session (or Stop first, then open it from Recent Captures).

Sessions are archived automatically, so you can stop capturing and revisit a session days later.

Inspect a request

Tap any row in the session list to open the detail view. What you get:

• Overview — URL, status, timing breakdown (DNS, connect, TLS, request, response), sizes, and destination routing such as Map Remote forwards.
• Headers — full request and response headers, including cookies.
• Body — formatted JSON, raw text and hex views; gzip, deflate and brotli are transparently decoded. Encrypted bodies covered by an AES rule get a one-tap AES Decrypt toggle.
• Streaming — Server-Sent Events render as an event list; WebSocket conversations show every frame, with Protobuf decoding when a schema is supplied.

Use the search field to filter the session by URL, and the filter icon to narrow by method, status class, content type or duration.

Share the results

From a session or the detail view, use Export HAR to produce a standard HTTP Archive file. HAR opens in Charles, Chrome DevTools, Postman and most analysis tools — handy when a teammate needs the exact request you just debugged.

Capture from other devices (LAN proxy)

Want to inspect traffic from a Mac, an Apple TV or a test device? Enable LAN Capture on the Capture tab, then configure the displayed IP:port as the HTTP proxy on the other device. Its traffic flows through your iPhone and appears in the same session list, with HTTPS decrypted by the same CA. Install and trust the CA on the client device too (the certificate management page can serve it over Wi-Fi).

Good to know before you go deeper

• Nothing leaves the device. Parsing, decryption, storage and HAR export all happen locally. There is no cloud component in the capture path.
• Apple’s own domains are skipped by default to keep iCloud and push services healthy. You can opt into capturing them in settings.
• A capture session only records while the VPN is on. Stopping capture disconnects the tunnel; apps then use the network directly.
• Rules apply live. Rewrite, mock and routing rules saved on the Rules page take effect on the next request — no VPN restart needed.

Where to go next

• Rules — every rule type on the Rules page: URL rewrite, filtering, hosts mapping, local mock responses, request forwarding, server replay, breakpoints, network simulation and AES decryption.
• Capture Scripts — a JavaScript hook system that runs inside the capture engine to modify any request or response.