API Tester

A minimal HTTP client that runs entirely in your browser: pick a method, set the URL, headers, and body, and hit Send. The request is a real fetch() call, and nothing is relayed through a server.

Private by architecture: All processing is 100% client-side memory. Your data never leaves this browser tab.

HTTP Request

Presets:

Response Inspector

Awaiting Request

Choose a method, enter a CORS-enabled endpoint, and click Send. Real-time status, latency, headers, and body will render here.

About This Tool

Sends a real HTTP request with the browser's own fetch() API. The method, URL, headers, and body you set are used exactly as given, and the response status, headers, body, and timing are shown in real time. There is no backend relay: the request leaves your browser directly for the URL you typed.

CORS-restricted APIs will fail here. Browsers block cross-origin responses unless the server sends CORS headers (Access-Control-Allow-Origin) allowing it. Most production APIs not configured for public browser access will be blocked by browser security. Same-origin APIs and CORS-enabled endpoints function normally.

Key Features

Five HTTP Methods: Supports GET, POST, PUT, PATCH, and DELETE with full header customizability.
Key/Value Header Editor: Add, edit, or remove header rows freely. Blank rows are cleanly omitted.
Dynamic Body Field: Automatically shows for methods carrying payloads and hides for GET requests.
Formatted JSON Rendering: Automatically parses and indents JSON responses, displaying raw text for non-JSON content.
Client Latency Measurement: Calculates precise round-trip duration from initial dispatch to response receipt.
Zero Data Logging: Zero proxy or server intermediary. Sensitive bearer tokens stay strictly on your device.

Frequently Asked Questions

Why does my request fail with a CORS or network error?

If the target API doesn't send Access-Control-Allow-Origin for this site's origin, the browser blocks the response before this tool ever sees it. This is a browser limitation, not a bug; the same request would succeed from a non-browser HTTP client.

Is my request sent through a server?

No. It is a direct fetch() call from your browser to the URL you entered, with no proxy and no logging.

Can I send authentication headers?

Yes, add them as header rows (for example, Authorization: Bearer token). They are sent exactly as entered and never stored.

Why is the body field hidden?

It only shows for methods that typically carry one: POST, PUT, PATCH, DELETE. GET requests are sent without a body.

Does it validate my JSON body before sending?

No, the body is sent as raw text exactly as typed. If the server expects JSON and it is malformed, the server response will indicate the error.