Send HTTP Request

Use this simple HTTP request tester to call REST APIs without installing anything. Pick a method, enter a URL, add query parameters, custom headers, authentication and a request body, then send it and review the status code, response time, size, headers and body. It is a lightweight, free alternative to desktop API clients such as Postman, Insomnia or Hoppscotch for quick everyday checks.

Developers, QA engineers, support teams and integration partners use it to verify that an endpoint is alive, confirm what a webhook receiver returns, reproduce a bug report, or try an API example from documentation. Every request you save stays in your own browser, so you can come back and re-run it in one click.

How to Use the HTTP Request Sender

1. Choose an HTTP method and paste the request URL (for example https://api.example.com/users).
2. Or click Import to paste a cURL command and populate the method, URL, params, headers, authentication and body automatically.
3. Add query parameters in Params. They are appended to the URL automatically, and editing the URL updates the table too.
4. Open Headers to add values such as Accept, X-API-Key or a custom User-Agent. Untick a row to disable it without deleting it.
5. For POST, PUT and PATCH, open Body and choose JSON, Text or Form URL-encoded. The matching Content-Type is added for you.
6. Use Auth for a Bearer token or Basic username and password. The Authorization header is built automatically.
7. Click Send and inspect the Body, Headers, Timings and Raw response tabs.
8. Click Save to keep the request in the sidebar. Use the + button to start a new one.

Features at a Glance

• All common methods: GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS.
• Params, headers and body: editable key/value tables with enable and disable checkboxes, plus JSON, text and form bodies.
• Authentication: Bearer token and Basic auth without hand-writing headers.
• Readable responses: status badge, response time, size, auto-prettified JSON, a full header list and a raw view.
• Timing breakdown: DNS lookup, connect, TLS handshake, first byte and total time for spotting slow endpoints.
• Copy as cURL: turn the current request into a command you can paste into a terminal, script or bug report.
• Import from cURL: paste commands from API documentation or browser developer tools and review the parsed request before applying it.
• Saved requests: stored privately in your browser's local storage, no account needed.

Understanding HTTP Methods

• GET: reads data. It should not change anything on the server and is safe to repeat.
• POST: creates a resource or triggers an action, usually with a JSON or form body.
• PUT: replaces an existing resource with the data you send.
• PATCH: updates only some fields of a resource.
• DELETE: removes a resource.
• HEAD: returns only the status and headers, useful for checking that a URL exists or has changed.
• OPTIONS: asks which methods and headers a server allows, often used for CORS checks.

Common Response Status Codes

• 200 OK / 201 Created / 204 No Content: the request succeeded.
• 301 / 302 / 307 / 308: the resource lives somewhere else. Check the Location header.
• 400 Bad Request: the server could not understand the request. Check JSON syntax and required fields.
• 401 Unauthorized: credentials are missing or invalid. Check your token or Basic auth values.
• 403 Forbidden: you are authenticated but not allowed, or the server blocks your IP address.
• 404 Not Found: the URL or resource ID does not exist.
• 429 Too Many Requests: you hit the API's rate limit. Wait and retry.
• 500 / 502 / 503: the server failed or is temporarily unavailable.

Tips for Testing APIs

• Send Accept: application/json so the API replies with JSON instead of HTML.
• Use the Raw request tab to confirm exactly what is sent, then copy it as cURL to share with teammates.
• If a request works here but fails in your browser app, the cause is usually CORS. Browsers enforce it, this tool does not.
• Never paste production secrets on a shared computer, because saved requests stay in local storage.

Limits and Privacy

• Requests are sent through our server so CORS restrictions do not apply, which also means the target API sees our server's IP address, not yours.
• Private, local and internal addresses (for example localhost and 192.168.x.x) are blocked for security.
• Only common web ports are allowed: 80, 443, 8080, 8443, 3000, 5000 and 8000.
• Redirects are not followed so you can see the exact 3xx response and Location header.
• Request bodies are limited to 1 MB, responses are shown up to 2 MB, and usage is rate limited to 20 requests per minute.
• We do not store your requests or responses. Saved requests stay in your browser only.

Need to inspect only the response headers and redirect chain of a web page? Try the HTTP Headers Checker. To receive requests instead of sending them, use the Webhook Tester, and to tidy up JSON payloads use the JSON Formatter.