v0.1.0 · MIT licensed
See every requeston your own machine
Reqeek runs an HTTP/HTTPS proxy locally and records everything that passes through it — method, status, timing, time to first byte, full body. No kernel extension, no router changes, and your traffic never leaves the machine.
Available for macOS and Windows
Click a host group to expand its requests, or switch the type tabs above to filter the list.
Everything worth keeping
From plain HTTP to decrypted HTTPS, from request headers to response bodies — Reqeek lays out the full shape of a request.
HTTP capture
Forwards plain HTTP requests and records method, URL, status code, timing, time to first byte and transferred bytes in both directions.
HTTPS decryption
Issues a site certificate per CONNECT request on demand, so you can read request headers, response headers and full bodies. Hosts that fail the handshake fall back to a transparent tunnel.
WebSocket
Handles plain ws and decrypted wss. After the upgrade succeeds, bytes are forwarded raw and traffic is counted in both directions.
Request details
Five panes: Headers, Payload, Preview, Response and Timing. JSON and XML render as collapsible trees; images and HTML preview in place.
Per-app attribution
Resolves the local app behind each request from its client source port. The sidebar totals requests per app — click one to see only its traffic.
Filters and search
Filter by resource type or keyword, with invert search, errors only and hide tunnels. The list groups by host and every column sorts.
System proxy management
Sets the system proxy when recording starts and restores it when you stop or quit. The previous configuration is snapshotted to disk first, so a failed port bind never touches your network settings.
Certificate management
Generate the root CA, install and trust it, check its trust state and remove it — all from inside the app, no digging through Keychain Access or certmgr.
How it works
No kernel extension, no network driver, no traffic leaving your machine. Reqeek uses the plainest approach available: a proxy running locally.
- 1
Check that the root certificate is trusted
When you click Start recording, Reqeek first checks whether the root CA is trusted. If it isn't, capture is refused and the UI stays on the certificate setup screen — better to say so up front than to leave you staring at a window that captures nothing.
- 2
Start the proxy, then take over the system proxy
The proxy starts on 127.0.0.1. System proxy settings are only changed after the port binds successfully, so a port conflict can't cut off your network.
- 3
Forward and record
Plain HTTP is forwarded and recorded directly. HTTPS arrives through CONNECT and is decrypted on port 443 only by default. Apple push and OCSP hosts are excluded out of the box and recorded as tunnels — host, bytes and duration only.
- 4
Restore on stop
Stopping restores the system proxy before shutting the proxy down. If the app exits unexpectedly, the next launch restores the system proxy from the snapshot written earlier.
A few defaults you might ask about
Every number here is read from the source, not guessed.
- Listen address
- 127.0.0.1
- Local connections only — nothing else on your network can reach it
- Proxy port
- 8989
- Configurable in settings, anywhere from 1024 to 65535
- Decrypted by default
- Port 443
- Everything else travels as a tunnel
- Excluded hosts
- push.apple.com and others
- Includes push.services.apple.com and all OCSP hosts, never decrypted
- Body retained per item
- 5 MiB
- Beyond that, only the byte count is kept
- Detail memory budget
- 64 MiB
- Evicted LRU by whole records — captured content is never written to disk
- Root CA validity
- 10 years
- Leaf certificates last 199 days and are cached for 512 hosts
Platform support
macOS and Windows are fully supported. Linux cannot capture yet.
| Capability | macOS | Windows | Linux |
|---|---|---|---|
| Set the system proxy automatically | Available | Available | Not available |
| Install and trust the root certificate | Available | Available | Not available |
| Start recording | Available | Available | Not available |
| Filter by source app | Available | Available | Not available |
Linux has packaging configuration only — there are no system proxy or certificate trust drivers. Trust state is permanently reported as unsupported, and starting capture requires a trusted certificate, so startup is refused. CI does not build Linux installers either.
The Windows system proxy and certificate trust drivers follow the public documentation and have not been fully verified on real hardware yet. Issues are welcome.
Keyboard shortcuts
Start, clear and search without leaving the keyboard.
- Start / stop recordingCmd/Ctrl+R
- Clear recordsCmd/Ctrl+K
- Search requestsCmd/Ctrl+F
- Open settingsCmd/Ctrl+,
- Move through the request list↑+↓
Security and privacy
A capture tool can see all of your traffic, so it had better be worth trusting.
Local connections only
The proxy binds to 127.0.0.1 and accepts nothing from your LAN or the internet.
The private key stays here
The root CA certificate and key live in the app data directory, with 0700 on the directory and 0600 on the key file. Anyone holding that key can forge any HTTPS site — never share ca.key.
Nothing is written to disk
Request details live in memory only, evicted LRU against a 64 MiB budget. Quitting leaves nothing behind.
The app itself never phones home
Reqeek sends no data anywhere. No account, no analytics, no telemetry.
One instance at a time
A single-instance lock stops two copies from restoring each other's system proxy settings.
Download Reqeek
Current version v0.1.0. Pick the installer that matches your machine.
Downloads point at GitHub Releases. If they are slow from where you are, a mainland China relay is available.
See all releasesWhat your OS will say the first time
- macOS
- The macOS build is ad-hoc signed and not notarized by Apple. Gatekeeper will block the first launch — choose Open Anyway under System Settings → Privacy & Security, or right-click the app in Finder and choose Open.
- Windows
- The Windows build has no code signing certificate, so SmartScreen may warn that Windows protected your PC. Click More info, then Run anyway.
Frequently asked questions
Why is trusting a root certificate required?
Decrypting HTTPS is, by definition, a man-in-the-middle. Reqeek generates a root CA on your machine and uses it to issue a temporary certificate for each host you visit. Browsers only accept those certificates if the system trusts that root CA. Without it, HTTPS traffic can only be recorded as tunnels — host, bytes and duration, no content.
Some apps can't be decrypted. Is it broken?
No. Apps using certificate pinning deliberately refuse to be decrypted — that is their security model working as intended. Once a handshake fails, Reqeek adds that host to its exclusion list and stops retrying, recording it as a tunnel instead.
macOS says the developer cannot be verified, or that the app is damaged.
The current build is ad-hoc signed and not notarized by Apple. On first launch, find the blocked notice under System Settings → Privacy & Security and choose Open Anyway. Alternatively, right-click the app in Finder, choose Open, then confirm in the dialog.
Why can't Linux capture?
Linux has electron-builder packaging configuration only — there are no drivers for the system proxy or certificate trust. Trust state is permanently reported as unsupported, and starting capture requires a trusted certificate, so startup is refused outright. CI does not build or upload Linux installers either.
Port 8989 is already in use. What now?
Change the port in settings — anything from 1024 to 65535. Reqeek confirms the new port binds before it touches your system proxy settings, so a conflict never breaks your network.
Will the system proxy be left behind after I quit?
Stopping capture or quitting normally restores it automatically. If the process is force-killed, the next launch restores the system proxy from the snapshot written earlier. You can also turn it off yourself under System Settings → Network → Proxies.