See inside your HTTP and HTTPS traffic.
VioLens is an open source HTTPS debugger. I built it to replace Fiddler Classic, so if you've used Fiddler you'll know your way around: every request your browsers and apps make shows up in a list, and you can pause them, change them and send them again. It's free, including at work, and it runs on Windows, Mac and Linux.
This is the release candidate for 1.0. It runs on 64-bit Windows 10 and 11, Apple silicon Macs with macOS 11 or later, and 64-bit Linux.
Capturing a page load, reading the request and response headers, and the Timing tab's DNS, connection, TLS and wait breakdown.
What it does
Point a browser, an app or a phone at VioLens and every request shows up in the list, already decrypted and decompressed.
Captures HTTPS and HTTP
HTTPS is decrypted with a root certificate created on your own machine. VioLens sets itself as the system proxy while it runs and puts your settings back when you stop it.
Shows you what was sent
Headers, Raw, JSON, WebForms, images, Hex and Cookies views, plus every WebSocket message. JSON, CBOR and MessagePack open as a tree, and Markdown is rendered. gzip, deflate, Brotli and zstd bodies are decompressed for you.
Breakpoints and AutoResponder
Pause a request or response, edit it and let it carry on. Or answer requests yourself with a file, a redirect, a delay or an error, so they never reach the server.
Composer and Replay
Write a request from scratch or start from a captured one, and send it byte for byte, binary bodies included. Press R to send the selected request again.
Timing
A waterfall of each request's phases, a Timing tab for the details, and Statistics showing bytes, compression savings and the slowest requests.
Find, Compare and TextWizard
Search inside bodies, put two sessions side by side, and decode Base64, URL encoding, JWTs and more.
QuickExec, scripts and extensions
Type commands like ?login or bpu /api. Load a CustomRules.js-style script to change traffic on the way through, or add .NET extensions. Test scripts can drive a capture with violens-exec.
Works on a company network
Corporate proxies, PAC scripts and proxy sign-in all work, and VioLens can answer a server that asks for a client certificate. Phones and other devices can go through it too, and IT can lock settings for everyone with Group Policy or a policy file.
Captures from other people
When a problem only shows up on a customer's PC, send them VioLens Capture. It has one window and three buttons, and gives you back a SAZ file. VioLens also opens the HTTP in Wireshark and tcpdump captures.
Coming from Fiddler Classic?
Fiddler Classic's license now allows non-commercial use only, so a lot of people need something else for work. I've used Fiddler for over 15 years, so VioLens works the way I expect a debugging proxy to work. The web has changed a lot since Fiddler Classic's last big update, though, so it also does some things Fiddler never did.
What carries over
- Your .saz files open as they are, and VioLens saves them too.
- FiddlerScript: OnBeforeRequest, OnBeforeResponse, Rules menu options, context actions and columns.
- Extensions can be ported from their source with few changes. Three ported ones come with the installers.
- Breakpoints, AutoResponder rules, Composer, Replay, Find, TextWizard and the QuickExec box.
- FiddlerCap and ExecAction.exe have their own versions: VioLens Capture and
violens-exec.
What's new
- Timing laid out the way the browser developer tools show it.
- Compare is built in, so there's no separate diff program to install.
- HTTP/2 between browsers, VioLens and servers, on by default. Debugging HTTP/2.
- Live WebSocket messages, with compressed and fragmented ones put back together.
- HAR import and export, zstd and Brotli, and cookie warnings based on today's browser rules.
- It runs on Mac and Linux as well as Windows (it's built on .NET 10 and Avalonia). Setting it up on Linux.
Building your own tool?
The proxy engine is a separate .NET library, Violens.ProxyCore, published on NuGet with each release. You can build your own debugger, capture tool or test harness on it, with Fiddler-style hooks such as OnBeforeRequest, AutoTamper, session flags and breakpoints. If your app is still on .NET Framework, Violens.ProxyHost.Client runs the engine in a small process of its own and talks to it for you. Its API is frozen for 1.0, so updates after that won't break your code until 2.0.
Free, and MIT licensed
You can use VioLens for anything, at work or at home. 1.0 is close, so this is a good time to try it. If something breaks, I'd like to hear about it before the final release.