mitmproxy — An open-source TLS-capable intercepting proxy for inspecting, modifying and replaying HTTP traffic.
What it is
mitmproxy is a free, open-source interactive HTTPS proxy for debugging, testing and security work, exposing one interception engine through a terminal UI, a web interface and a scriptable command line.
Editor's review
Long-form introduction by the BetterPicker editors · checked against the official site · Oct 23, 2026
mitmproxy is the tool security researchers, QA engineers and backend developers reach for when they need to read TLS-encrypted traffic instead of guessing at it. It runs as an HTTP proxy that sits between a client and the network, generates its own certificate authority so it can terminate TLS, and turns HTTP/1, HTTP/2, HTTP/3, WebSocket and other SSL/TLS-protected traffic into readable, editable flows. The same engine ships in three shapes: a keyboard-driven terminal interface, mitmweb for a browser-based view, and mitmdump, a script-friendly command-line mode best read as tcpdump for HTTP. Messages can be intercepted on the fly, modified before they reach their destination, pretty-printed from HTML to Protobuf, and replayed later to a client or server, and a Python API lets addons rewrite traffic programmatically. Setup walkthroughs show how quickly an install turns into captured traffic, and users report using it to reverse-engineer private mobile APIs; reviewers note the technique's inherent caveats: every client must install and trust the generated root certificate, apps that pin certificates refuse to connect, and the console UI stays austere until the keystrokes become second nature. It is free and open source under the MIT license, running on macOS, Linux and Windows; the current release is 12.3.0.
What it does well
Deep traffic visibility: full HTTPS interception through generated certificates, decoding and pretty-printing for formats from HTML and JSON to Protobuf, plus support for HTTP/2, HTTP/3 and WebSockets rather than plain HTTP alone.
One engine, three interfaces: the terminal UI for live triage, mitmweb for a DevTools-style browser view of any device, and mitmdump for headless capture and scripting, with flows saved to disk and replayed against client or server.
Programmable end to end: the Python addon API can modify requests mid-flight, fabricate responses, redirect hosts or automate checks, which is why walkthroughs lean on it for API scraping, regression fixtures and penetration-testing tooling.
Who it's for
Developers debugging integrations, QA engineers who need to replay and mutate requests against a real backend, security researchers measuring application behavior, and anyone reverse-engineering what a mobile app or IoT device actually sends. If DevTools shows only the browser's side and a packet sniffer shows only ciphertext, this is the middle layer. It asks for comfort with certificates, proxy settings and, ideally, a little Python.
Where it falls short
Trust setup is manual and high-stakes: each client needs the generated CA certificate installed and explicitly trusted, which weakens protections you normally rely on, so walkthroughs rightly warn against doing it casually or on untrusted networks; certificate-pinned apps simply refuse.
The console interface is austere: powerful but keystroke-driven, with no mouse-driven GUI to lean on; many users report they default to mitmweb for anything beyond quick filtering.
An inspection tool, not infrastructure: sitting in the traffic path adds latency and failure modes, capture of very high volumes needs mitmdump tuning, and it will not stand in for a production caching or forward proxy.
Specs at a glance
Facts from the official site · not editorial opinion
| Latest version | 12.3.0 |
|---|---|
| Price | Free; open source with no paid tiers |
| Platforms | macOS, Linux and Windows |
| Open source | Yes - MIT license |
| Core capability | Interactive TLS-termination proxy that intercepts, decodes, modifies and replays HTTP and WebSocket traffic |
| Integrations | Terminal UI, mitmweb browser interface and mitmdump CLI; Python addon API; browser, mobile and IoT clients via system proxy settings |
| Best for | Developers, QA engineers and security researchers who need to see and alter encrypted HTTP traffic from any client |
Frequently asked questions
▸Is mitmproxy free?
Yes. mitmproxy is free and open source under the MIT license, maintained by its community. The console interface, mitmweb and mitmdump all come from the same install with no feature gates or accounts.
▸How is it different from browser DevTools or Wireshark?
DevTools only sees one browser's traffic, and a packet sniffer sees encrypted bytes it cannot open. mitmproxy terminates TLS in the middle, so it can read, edit and replay traffic from any application you point at it - browsers, mobile apps or command-line tools.
▸How do I capture traffic from a phone or mobile app?
Run mitmproxy on a computer, set the phone's Wi-Fi proxy to that machine's address, then open the built-in certificate page in the phone's browser and install and trust the generated CA certificate. Note that apps using certificate pinning will refuse the connection.
▸Can it modify traffic automatically?
Yes. Beyond interactive interception, you write Python addons and run them with mitmdump to rewrite requests, fake responses or redirect hosts on the fly - useful for testing error handling, mocking backends or feeding modified data to a client.
Video reviews
5 review videos aggregated · praise and criticism included alike · click through to the original video
Channels that covered it
Channels are aggregated as sources only — we don’t rate creators
Related tools
Where to go next
External links open in a new tab; external content is independent of this site.
Link down? Every object page is re-checked monthly.