Why does my request fail with a possible CORS error?

There is no proxy: requests are sent by your browser, so the same-origin policy applies. The server must return Access-Control-Allow-Origin, and for JSON bodies, custom headers or methods like PUT and DELETE it must also answer the OPTIONS preflight. Browsers hide the exact reason from web pages, but the DevTools console (F12) shows it. Add CORS headers to your own API, or copy the request as curl and run it in a terminal for APIs you cannot change.

Why are some of my headers ignored?

Headers such as Host, Cookie, Origin, Referer, Content-Length, Accept-Encoding, Connection and anything starting with Sec- are controlled by the browser and cannot be set by scripts; the tool flags these rows. To send cookies, enable the credentials option in Settings — the server must allow credentialed cross-origin requests.

Why do I only see some of the response headers?

For cross-origin requests the browser only exposes a few safelisted headers such as Cache-Control, Content-Type, Content-Length and Expires. Anything else must be listed by the server in Access-Control-Expose-Headers. Same-origin requests, or servers that expose everything, show the full list.

Are my tokens, passwords and request data uploaded or stored?

Nothing is uploaded: requests go straight from your browser to the URL you enter and this site never sees them. The history lives only in your browser and never stores the token or password from the Auth tab; values of sensitive headers such as Authorization and Cookie are blanked and files are not saved. You can clear the history at any time.

📮

📮HTTP Request Tester Online - Browser Postman for API Testing

When you are wiring up a frontend, debugging a backend or trying a third-party API, you often just want to fire off a request and see what comes back. This is a lightweight Postman in your browser. Pick a method and enter a URL; the query string is split into an editable table that stays in sync with the URL both ways. Add headers row by row and toggle each one on or off. The body can be JSON (validated as you type, with one-click formatting), plain text, XML, x-www-form-urlencoded or multipart/form-data with local file uploads, and the Auth tab builds the Authorization header from a Bearer token or Basic auth username and password. After sending you get the status code, total time and time to first byte, response size and the readable response headers; JSON, XML and HTML are pretty-printed, images are previewed, HTML renders in a sandbox, and the body can be copied or downloaded. You can paste a curl command to import a request, copy the current request as curl to replay it in a terminal, set a timeout and cancel at any time. Sent requests are kept in a local history in this browser, without credentials or files. Requests go directly from your browser to the target, never through this site, so the API must allow CORS.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use HTTP Request Tester

1Choose a method and enter the URL, then fill in query params, headers, body and auth as needed
2Click Send and review the status, timing, size, headers and the formatted body
3Copy the request as curl, download the response or reload a request from history

FAQ

Why does my request fail with a possible CORS error?: There is no proxy: requests are sent by your browser, so the same-origin policy applies. The server must return Access-Control-Allow-Origin, and for JSON bodies, custom headers or methods like PUT and DELETE it must also answer the OPTIONS preflight. Browsers hide the exact reason from web pages, but the DevTools console (F12) shows it. Add CORS headers to your own API, or copy the request as curl and run it in a terminal for APIs you cannot change.
Why are some of my headers ignored?: Headers such as Host, Cookie, Origin, Referer, Content-Length, Accept-Encoding, Connection and anything starting with Sec- are controlled by the browser and cannot be set by scripts; the tool flags these rows. To send cookies, enable the credentials option in Settings — the server must allow credentialed cross-origin requests.
Why do I only see some of the response headers?: For cross-origin requests the browser only exposes a few safelisted headers such as Cache-Control, Content-Type, Content-Length and Expires. Anything else must be listed by the server in Access-Control-Expose-Headers. Same-origin requests, or servers that expose everything, show the full list.
Are my tokens, passwords and request data uploaded or stored?: Nothing is uploaded: requests go straight from your browser to the URL you enter and this site never sees them. The history lives only in your browser and never stores the token or password from the Auth tab; values of sensitive headers such as Authorization and Cookie are blanked and files are not saved. You can clear the history at any time.