A Windows desktop app for sending HTTP requests to APIs and inspecting the responses. Organise requests into collections, switch between environments like Dev, QA, and Prod, add automated checks, and run whole collections in one go — with a full built-in security-testing toolkit.
From a single request to automated collection runs and security testing — all in one native desktop app, with your data stored locally.
All HTTP methods, {{variable}} highlighting, query/path params, header tables with bulk edit, and bodies for form-data, raw JSON/XML, binary, and GraphQL.
Inherit from parent, API Key, Bearer, Basic, Digest, JWT (HS256/384/512), and OAuth 2.0 (client credentials / password grant) with one-click token refresh.
No-code assertions, "set variables from response" rules, Python pre/post-request scripts with a pm API, and a Collection Runner with iterations and pass/fail summaries.
Response audits (security headers, cookie flags, exposed secrets), an encoder/hash toolkit, a JWT workbench, Repeater, Intruder fuzzer, and an IDOR/BOLA matrix.
A built-in HTTP/HTTPS MITM proxy with its own CA — capture live traffic, then send any request straight to the Repeater or Intruder.
Import Postman v2.0/2.1, OpenAPI 3.x / Swagger 2.0, and cURL. Export Postman collections, and generate snippets for cURL, Python, JS fetch, axios, C#, PowerShell, and Go.
Click any image to view it full size.
HTTP methods
Auth schemes
Data stays on your PC
Accounts required