# HTTP Request Tester Online - Browser Postman for API Testing

> Free online HTTP client: send GET, POST, PUT or DELETE with params, headers, JSON, form or file bodies and auth, then inspect status, timing, headers and body.

- URL: https://qilingtools.com/en/http-request
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Developer](https://qilingtools.com/en/tags/dev), [Network & HTTP](https://qilingtools.com/en/tags/network)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

When you are wiring up a frontend, debugging a backend or trying a third-party API, you often just want to fire off a request and see what comes back. This is a lightweight Postman in your browser. Pick a method and enter a URL; the query string is split into an editable table that stays in sync with the URL both ways. Add headers row by row and toggle each one on or off. The body can be JSON (validated as you type, with one-click formatting), plain text, XML, x-www-form-urlencoded or multipart/form-data with local file uploads, and the Auth tab builds the Authorization header from a Bearer token or Basic auth username and password. After sending you get the status code, total time and time to first byte, response size and the readable response headers; JSON, XML and HTML are pretty-printed, images are previewed, HTML renders in a sandbox, and the body can be copied or downloaded. You can paste a curl command to import a request, copy the current request as curl to replay it in a terminal, set a timeout and cancel at any time. Sent requests are kept in a local history in this browser, without credentials or files. Requests go directly from your browser to the target, never through this site, so the API must allow CORS.

## How to use

1. Choose a method and enter the URL, then fill in query params, headers, body and auth as needed
2. Click Send and review the status, timing, size, headers and the formatted body
3. Copy the request as curl, download the response or reload a request from history

## Features

- GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS
- Query parameter table synced with the URL
- JSON, text, XML, urlencoded forms and form-data file uploads
- Bearer token and Basic auth helpers
- Status, total time, TTFB, size and response headers
- Pretty JSON / XML / HTML, image and HTML preview
- Import from curl, copy as curl, local history

## FAQ

### Why does my request fail with a possible CORS error?

There is no proxy: requests are sent by your browser, so the same-origin policy applies. The server must return Access-Control-Allow-Origin, and for JSON bodies, custom headers or methods like PUT and DELETE it must also answer the OPTIONS preflight. Browsers hide the exact reason from web pages, but the DevTools console (F12) shows it. Add CORS headers to your own API, or copy the request as curl and run it in a terminal for APIs you cannot change.

### Why are some of my headers ignored?

Headers such as Host, Cookie, Origin, Referer, Content-Length, Accept-Encoding, Connection and anything starting with Sec- are controlled by the browser and cannot be set by scripts; the tool flags these rows. To send cookies, enable the credentials option in Settings — the server must allow credentialed cross-origin requests.

### Why do I only see some of the response headers?

For cross-origin requests the browser only exposes a few safelisted headers such as Cache-Control, Content-Type, Content-Length and Expires. Anything else must be listed by the server in Access-Control-Expose-Headers. Same-origin requests, or servers that expose everything, show the full list.

### Are my tokens, passwords and request data uploaded or stored?

Nothing is uploaded: requests go straight from your browser to the URL you enter and this site never sees them. The history lives only in your browser and never stores the token or password from the Auth tab; values of sensitive headers such as Authorization and Cookie are blanked and files are not saved. You can clear the history at any time.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.