Getting Started: Capture Your First HTTPS Request
Here’s how to use a packet capture tool, with Trace Eagle as the example, in three steps: install the desktop app and open it (macOS / Windows / Linux, no registration or login), pick a capture method and click Start, then click any entry in the request list to read it in plaintext. For your first run, use per-process capture on your own browser — no proxy to configure and no certificate to install — and captured HTTPS is decrypted automatically, so you can read your first decrypted request within minutes.
Trace Eagle is a free, cross-platform packet capture and decryption tool that captures traffic on both your computer and your phone.
How do I install and launch Trace Eagle?
Section titled “How do I install and launch Trace Eagle?”- Follow Install to download the desktop app for your platform (macOS / Windows / Linux).
- Open the app. On first launch it may ask for system permissions (low-level capture needs them); just approve.
- No registration, no login: open it and it just works.
What’s the fastest way to see my first capture?
Section titled “What’s the fastest way to see my first capture?”Want to see results immediately? Use per-process capture: the tool launches your browser for you and captures only that one program, decrypting everything automatically, with no proxy to configure and no certificate to install.
- Go to “Per-process capture” and pick your browser (or enter a launch command).
- Click Start, and the tool launches the browser.
- In the browser, open any website.
- Requests appear in the request list immediately; click one to see the decrypted plaintext: request line, headers, body, and the response too.
Which capture method should I use for my target?
Section titled “Which capture method should I use for my target?”Different targets call for different capture methods. Pick one from the list below:
| What you want to capture | Which capture method |
|---|---|
| A local browser / program, and you also want to edit and replay packets | Proxy capture |
| All traffic on the whole machine, including traffic that does not go through the proxy (such as WeChat mini-programs), UDP / QUIC, and DNS | NIC capture |
| Just one program, with automatic decryption and no certificate | Per-process capture |
| An app that uses certificate pinning or custom encryption you can’t decrypt | App-layer plaintext |
| Built-in system apps and stubborn applications | System-level capture |
| Traffic from an iPhone / iPad | iOS capture |
| Traffic from an Android phone | Android capture |
If you’re unsure, start with proxy capture: it’s the most general, it produces plaintext and lets you edit and replay packets, and it can capture phones and LAN devices along the way.
Where do I read what I captured?
Section titled “Where do I read what I captured?”- Request list: every captured flow appears here in order; click to expand its details.
- Automatic decryption: when the session key for a flow is available, the tool automatically decrypts the ciphertext into plaintext. For where the keys come from and how far support goes, see how to decrypt HTTPS.
- Raw and plaintext side by side: view both the decrypted request / response and the underlying raw bytes.
- Process attribution: every flow is labeled with the program that sent it, so you can recognize it at a glance even when everything is mixed together.
For how to read and decode what you captured, see Inspect and decode; to find differences between two requests, see Request comparison.
If the problem is in the page rather than the API (a layout that breaks only on the phone, a blank H5 page, or finding which line of JavaScript sent a request), use the web inspector: full developer tools on your computer for the page on the device.
What if I can’t capture or can’t decrypt?
Section titled “What if I can’t capture or can’t decrypt?”| Symptom | Most likely | What to do |
|---|---|---|
| Not a single request | The target doesn’t use the system proxy | Switch to NIC capture; at the NIC layer, everything is capturable |
| Captured, but it’s all ciphertext | No certificate installed, or the app uses certificate pinning | Install the capture certificate, or switch to app-layer plaintext |
| Certificate installed on the phone but still can’t capture | Android 7 and above don’t trust user-installed certificates | See the no-cert-install method in Android capture |
| Can’t see HTTP/3 / QUIC | It runs over UDP, which ordinary proxies can’t see | Use NIC capture together with H3 decryption; see TLS decryption |
For more questions, see the FAQ.
What can I do after capturing?
Section titled “What can I do after capturing?”Once you’ve captured, decrypted, and understood a request, these are the everyday high-frequency features:
- Rewrite requests (rewrite rules and breakpoint interception): change requests and responses without touching code, or intercept a request mid-flight to edit it by hand.
- Request composing and replay: edit any request and resend it; even endpoints with signatures and timestamps can be truly replayed.
- Session replay and load testing: replay a string of requests in batches, or load-test a single endpoint in place.
- Generate code and export API docs: turn one request into code in multiple languages, and reverse an entire session into an OpenAPI document.
Is Trace Eagle free?
Section titled “Is Trace Eagle free?”Yes. Every feature is free with no feature paywall, and it works as a free alternative to Charles or Fiddler.
Can I capture traffic from phone apps too?
Section titled “Can I capture traffic from phone apps too?”Yes. Phone capture runs through a connected computer: iOS needs no jailbreak — see how to capture iOS traffic — and Android has certificate-free methods in Android capture.
Is my captured data uploaded to the cloud?
Section titled “Is my captured data uploaded to the cloud?”No. Trace Eagle is local-first with no telemetry; captured traffic stays only on your machine.
What if my computer can’t get online after capturing?
Section titled “What if my computer can’t get online after capturing?”When capture stops, the app automatically restores any network settings it changed, and there’s a recovery fallback even after an abnormal exit, so normal internet use isn’t affected.