FREE · OPEN SOURCE · RUNS IN YOUR BROWSER

Send a request.
See the whole picture.

Test an endpoint, inspect a response, and keep moving. A free, open-source HTTP client that connects straight from your browser.

  • No account
  • No proxy
  • Just HTTP
TRY AN EXAMPLEJSON API
GEThttps://nx.mtex.dev/status
200 OKIllustrative response
{
  "status": "success",
  "service": "nx.mtex.dev",
  "direct_request": true
}
Open the request in the app

Make your next request.

Choose an example or paste your own endpoint.

Ctrl / Cmd + Enter to send

Request
KEYVALUE
Response Ready when you are
- ms / - B
RESPONSE

Ready to send

Your response will appear here.
Try the example above, or bring your own URL.

CMD / CTRL + ENTER TO SEND
Requests sent directly from your browser
THE ESSENTIALS, IN REACH

A focused tool for the whole request.

01

Build without the busywork.

Seven HTTP methods. Query parameters that stay in sync with your URL. Headers, raw bodies, and JSON formatting when you need them.

PARAMSHEADERSBODY
02

Read more than the status code.

Switch between pretty JSON, raw text, and response headers. Check elapsed time and payload size. Copy or download the result.

PRETTY / RAWTIMINGHEADERS
03

Take the next step with you.

Export a request as cURL, share a link for someone to review, or install the app for a dedicated workspace. Your workflow stays yours.

CURLSHARE LINKSPWA
BEFORE YOU SEND

Good to know.

A direct connection comes with a few browser rules. Here is what happens to your requests and your data.

CONNECTION

Your browser calls the API.

Requests use native fetch() and go directly to the target endpoint. Our server does not relay your API request, headers, body, or response.

Cookies are omitted. Browser-controlled headers cannot be overridden, and only response headers exposed by the API are visible.

CORS & CONNECTIVITY

The API has to let you in.

Cross-origin APIs must allow this site's origin through CORS. Some requests trigger an OPTIONS preflight that the API also needs to accept.

An HTTPS page cannot fetch an unencrypted HTTP endpoint. For blocked requests, use the editor's Direct browser request diagnostic, or export cURL to your terminal.

LOCAL HISTORY

Recent requests stay local.

History saves recent methods and URLs in this browser. Query strings and URL credentials are removed. Request headers, bodies, and responses are not saved.

URL paths can still contain sensitive data. Use Clear in Recent requests to remove history. Your color-theme preference is also stored locally.

SHARING

A link is readable by anyone.

Share links include the request URL and method. Headers and body are included only when you opt in. Query parameters remain part of the shared URL.

Review links for secrets before sharing; they may enter browser history or hosting logs. Shared requests load for review and are never sent automatically.

OFFLINE & INSTALLATION

The workspace can come along.

Open the app to install it using your browser's install option, where supported. After its first successful service-worker installation, the app shell can open offline.

Sending requests still needs a connection. API responses and shared request URLs are not stored in the offline cache.

LIMITS & DEMOS

Built for text and JSON APIs.

Requests time out after 30 seconds. Response previews are limited to 5 MB. GET and HEAD requests omit a body; binary responses are displayed as text.

External presets use MTEX Nexus; availability and CORS depend on that service. Local status and echo presets are also available in the editor.

You control the send button. Loading this page or opening a shared request does not send a request to the API. Review your endpoint and payload before you send.

Share request

The URL and query parameters are included. Review for tokens or private data before sharing. Links may be saved in browser history and server logs.

Short links via meinlink.at / href.nz are planned, pending implementation in the ternis.link codebase.

Direct browser requests & CORS

100% Client-Side Zero Proxy Zero Logging Local Privacy

How it works

Every HTTP request in httpclient.de is dispatched directly from your browser using the native fetch() API. There is no backend server proxy, no cloud relay, and no central logging. Your request payloads, headers, and API keys never leave your machine.

Why do some requests fail?

Because requests are sent directly by your browser, web security standards are enforced by your browser sandbox:

1. Cross-Origin Resource Sharing (CORS)

Browsers block reading responses from different origins unless the server returns the Access-Control-Allow-Origin header. Custom headers and POST/PUT methods with JSON payloads also require the server to accept preflight OPTIONS requests.

2. Mixed Content Security

Modern browsers block plain http:// requests from secure https:// pages. APIs must support HTTPS when using the online client.

3. Forbidden Browser Headers

Headers like Host, Origin, User-Agent, Cookie, and Referer are restricted by the browser Fetch specification and cannot be overwritten via JavaScript.

Solutions & Workarounds

Run in Terminal (Bypass CORS)

Copy your request as a cURL command. Terminal cURL does not enforce browser origin sandboxes.

Enable CORS on your Server

If you control the API, add these HTTP headers to permit browser requests:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: *

Test with CORS-ready endpoints

Quickly load verified endpoints that support browser requests:

Live Connection Diagnostic

Test if an endpoint can be reached directly from this browser right now: