How to capture and decrypt HTTPS traffic on a Mac

Fiddler Classic never ran on a Mac. VioLens does: it shows you every request your browsers and apps make, decrypted, and you can change them if you need to.

You’ll need a Mac with Apple silicon (M1 or newer) and macOS 11 or later.

1. Install VioLens

Download the disk image, open it and drag VioLens into Applications.

VioLens is signed with an Apple Developer ID and notarized by Apple, so it opens like any other app. If macOS asks whether you want to open an app downloaded from the internet, click Open. (If you built VioLens yourself, see Opening it on a Mac.)

2. Start capturing

Click Start. VioLens sets itself as your Mac’s proxy while it runs, so traffic from Safari, Chrome, Edge and most other apps goes through it.

3. Trust the root certificate

To decrypt HTTPS, VioLens needs a root certificate your Mac trusts. The first time you click Start, VioLens explains this and asks before it adds a certificate called DO_NOT_TRUST_ViolensRoot to your login keychain. macOS may ask for your password.

Firefox keeps its own list of certificates and ignores the keychain unless you tell it otherwise, so VioLens also turns on Firefox’s setting to trust what macOS trusts. If Firefox was open, restart it.

The certificate is created on your Mac and only used there. Nothing VioLens captures leaves your Mac unless you save or send it yourself.

4. Browse, and read the traffic

Load a page or use an app, and each request appears in the session list. Click one to see its request and response: headers, the decoded body, JSON pretty-printed, cookies, images and a hex view. The Timing tab shows where the time went: DNS, connecting, the TLS handshake and waiting for the server.

Type in the filter box to narrow the list, for example host:api.example.com or status:4xx.

5. Stop when you’re done

Click Stop. VioLens puts your Mac’s proxy settings back the way they were. To remove the certificate as well, choose Tools > Remove Root Certificate.

If you don’t see some traffic

An app ignores the system proxy. Some apps, and most command-line tools, don’t use macOS’s proxy setting. Point them at VioLens yourself, using the port shown in the status bar. For example, curl takes -x http://127.0.0.1:PORT.
An app rejects the certificate. Some apps only trust certain certificates (certificate pinning), so their HTTPS can’t be decrypted by any proxy.
Your company network uses a proxy. VioLens goes through it automatically, PAC scripts included. See Connections in the User Guide.