Ready to send

Your response will appear here.
Try the example above, or bring your own URL.

CMD / CTRL + ENTER TO SEND

Direct browser request failed. This usually happens when the API doesn't allow cross-origin requests (CORS), is blocked by mixed-content security, or is offline.

Requests sent directly from your browser

Share request

The URL and query parameters are included. Review for tokens or private data before sharing. Links may be saved in browser history and server logs.

Include headers (may contain credentials) Include request bodySHARE LINK

Short links via meinlink.at / href.nz are planned, pending implementation in the ternis.link codebase.

Direct browser requests & CORS

100% Client-Side Zero Proxy Zero Logging Local Privacy

How it works

Every HTTP request in httpclient.de is dispatched directly from your browser using the native fetch() API. There is no backend server proxy, no cloud relay, and no central logging. Your request payloads, headers, and API keys never leave your machine.

Your BrowserDirect fetch()

TCP / TLS

Target APIDirect response

Why do some requests fail?

Because requests are sent directly by your browser, web security standards are enforced by your browser sandbox:

1. Cross-Origin Resource Sharing (CORS)

Browsers block reading responses from different origins unless the server returns the Access-Control-Allow-Origin header. Custom headers and POST/PUT methods with JSON payloads also require the server to accept preflight OPTIONS requests.

2. Mixed Content Security

Modern browsers block plain http:// requests from secure https:// pages. APIs must support HTTPS when using the online client.

3. Forbidden Browser Headers

Headers like Host, Origin, User-Agent, Cookie, and Referer are restricted by the browser Fetch specification and cannot be overwritten via JavaScript.

Solutions & Workarounds

Run in Terminal (Bypass CORS)

Copy your request as a cURL command. Terminal cURL does not enforce browser origin sandboxes.

Enable CORS on your Server

If you control the API, add these HTTP headers to permit browser requests:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: *

Test with CORS-ready endpoints

Quickly load verified endpoints that support browser requests:

Live Connection Diagnostic

Test if an endpoint can be reached directly from this browser right now: