I feel obliged to mention Fiddler. The tool I loved almost 20 years back and felt like it came from future. IIRC it was/is more powerful than Charles. Fiddler was Windows only but at one time they had builds for other platforms in works. Sadly they got acquired which changed their roadmap, and I had also moved on from Windows.
I built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically goes App -> Packet tunnel -> SOCKS -> a child process (I used https://github.com/AdguardTeam/gomitmproxy) to handle the sniffing and reencryption.
I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days.
Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone without paying an extra fee to Apple. The error message when you sideload without a paid account doesn't make it obvious at all and it took me a good day or two before realizing .
> It's insane that I can't even develop for my own phone without paying an extra fee to Apple.
A Linux phone can’t come fast enough. Yes there is at least one, on ancient hardware. IMO a viable Linux phone requires hardware at most one generation old.
While vibe coding will get you something that potentially works, I've noticed LLMs are really bad at cleanly abstracting across multiple layers in this area. They usually will insist on parsing and serializing every field at every layer.
If you have the protocols/interfaces well defined up front it is very fast at building extensions, analytics or visualizations though.
mitmproxy/mitmweb offer a WireGuard server implementation to do pretty much this. You can grab any existing WireGuard VPN, scan a QR code to import the VPN config, and start monitoring (after installing the MITM certificate, of course).
The packet tunnel story is crazy. I'm glad Android allows you to just use network APIs without question as a developer.
I had excellent experiences w mitmproxy (and mitmdump) in 2016-17. At that point it was powerful and easily scriptable, making it far superior to charles for my purposes.
What I really like about mitmproxy is that it runs on my server with a certificate I trusted on my phone.
I then flip on WireGuard on my phone, pointed to mitmproxy, and seamlessly all traffic from my phone is decrypted and viewable through the website on my computer.
Except of-course all the applications these days that do certificate pinning, which is annoying, but for that we have Frida.
mitmproxy isn't the gold standard; it is Burp Suite, sadly.
Burp Suite uses a subscription model. Charles a model like Sublime Text: you buy it and get to keep the version forever, major upgrades available for a discount.
I had to chuckle at this one:
> If you purchased a Charles license prior to 1 May 2008 your existing license key is still valid for Charles 5.
So I guess in past they used a model where you'd have lifetime upgrades.
Which also made me think: I recognize this name! This has to be an older piece of software. Was it published on Freshmeat in the start of this century?
There's also some TUI for Wireshark, such as frontends for tshark. I think [1] looks interesting, since it can be used with a local LLM (via Ollama).
mitmproxy supports quite a few features that Charles doesn't and vice versa. You could use them as alternatives for basic browser traffic analysis (where they're both fine), but their features and capabilities cover different areas. Charles is user friendly and robust, mitmproxy has advanced scripting capabilities with a decent amount of community examples available. They complement each other.
Wireshark is extremely powerful and useful but it lives in a completely different category of tools. It's not a proxy so it can't modify traffic or inspect HTTPS [1], it's used to passively capture and analyze general network traffic and troubleshoot networking issues.
[1] without an elaborate setup, your program needs to be instructed to dump TLS encryption keys for Wireshark to read
I was a daily user of mitmproxy, until they changed all they keybindings around version 2. Tried a couple of times to get used to the new “TMUX” style, but switched to Charles Proxy.
Have mitmproxy gotten any better in usability over the years?
Just based on the images, is seems to have the same problems?
I generally prefer mitmweb, the web frontend for mitmproxy. I don't have much of a problem with their tmux-like UI, but I find mitmweb a lot easier to use than the keyboard shortcut based terminal navigation.
Burp Suite can do much of this as well, but the intent feels different.
Charles is very much about observing and understanding raw HTTP(S) traffic with minimal friction, which makes it handy for quick debugging, mobile app inspection, or client-side issues.
Burp leans heavily into security workflows: interception, replay, automation, and attack surface exploration. That power comes with more setup and a more opinionated UI.
I’ve found Charles useful when I want visibility without switching into “pentest mode,” whereas Burp shines when security analysis is the goal.
You can also check out Caido as an alternative, we are a newer player in the space but catching up very fast. Most of the Burp new features of the last 2 years are basically copying what we innovated in Caido.
That’s fair. I mostly stick with Burp because I’m very familiar with its workflows and tooling, and that familiarity matters a lot in day-to-day work.
That said, I genuinely appreciate having credible competitors to Burp. New tools entering the space tend to challenge long-standing assumptions, especially around UX and ergonomics, and that pressure usually benefits everyone.
Even if I don’t switch immediately, competition is healthy and often the reason established tools keep improving.
Proxyman is 100x value for 2x the price. I am not even kidding. Native UI, shortcuts, cert installation helper tools. And script editor to programmatically edit requests is so much better and powerful than Charles' request editor.
Likewise. I was a dedicated user of Charles for about a decade. It’s great, but if you are a macOS user, Proxyman is better, easier, and more macOS friendly.
At a previous workplace, Charles Proxy was not in the list of approved software. I don't recall the reason - it might have been cost, but we used lots of paid tools, and since it was in the restricted category, we couldn't pick and use (we handled a copious amount of Western PII, from reading, working on it, to storing it). Two were approved: Requestly and another was a link to an internal wiki with a really "interesting" process involving Wireshark and whatnot. Needless to say, that doc was one of the most clicked and least read. I tried Charles at a later place that offered a license, and I went back to Requestly, which I really found to be more straightforward or simpler to use.
"approved use" is usually just someone that doesn't understand what the software does.
I recently had the IT team at my work ban VNC client, they didn't understand it wasn't VNC server, which I could understand being a security risk, but the client? They're idiots.
If the devs behind Charles would just tweak their UI a bit, it would be the absolute perfect tool. Functionally it pretty much already is. Mainly being able to turn on and off and configuring features I use all the time (rewrite, map local, map remote) is always a journey through menu's that don't always make sense. The only functional thing I'm missing is some DNS stuff (e.g. throttling or breaking DNS specifically).
I tried using proxyman for a while, and while definitely powerful and more modern, it honestly didn't feel "better" or more powerful so I didn't go for yet another license.
I frequently use them both. The main reason why I can't leave Charles is the lack of session grouping in Proxyman. Seeing a huge list of irrelevant items is annoying after some point. In Charles, I can save that session with a name and move on to something else. It's almost impossible to leave one for the other at this point for me.
This goes without saying, but huge thanks to the both developers for making these available.
Same. At some point there was a new Charles version and I could not figure out how to use it the way I had used the old version (I admit I forget exactly what I was trying to do), and it was trivial in Proxyman. Proxyman also has a great app.
It makes working with Xcode simulators even easier by having a dedicated UI workflow to install the proxy certificates and restart the sim.
I used to face issues from time to time doing this with Charles having to restart my machine at times and not getting the certificates to work.
Proxyman makes this way nicer to work with and since switching I never faced certificate issues again.
Not trying to do an ad, but really glad I don‘t have to think about that anymore :)
Yes, Proxyman has great sim integration, including the ability to filter by apps within the sim. It's a far better macOS app than Charles, and I've never found it to be lacking a feature I used in Charles.
When I was still working with iOS, all of us on the team switched to Proxyman and found it much better than Charles. Developer experience wise that is (features, ui/ux, etc.) We ran into some issues with Charles and found Proxyman as the alternative. Don't remember the issues but we never looked back.
For my rather simple needs I've been using https://httptoolkit.com free edition, I like that it launches a independent Firefox window on its own for the intercepting so I don't have to touch my working browser or deal with configuring a proxy anywhere
From time to time, an "old" things reappears, since there's always a number of people who haven't heard of it (or just like upvoting things they like, I guess).
Readit News
https://www.telerik.com/fiddler
Deleted Comment
The closest free alternative is https://www.mitmproxy.org/ that is not even close.
And off course, https://www.wireshark.org/ but that is too generic and with a bigger learning curve.
Worth the money. And no subscription (or there weren't a subscription back then)
Did post the source somewhere at some point but my git server got corrupted and I haven't gone and fixed it. https://github.com/acheong08/apple-corelocation-experiments/...
I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days.
Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone without paying an extra fee to Apple. The error message when you sideload without a paid account doesn't make it obvious at all and it took me a good day or two before realizing .
A Linux phone can’t come fast enough. Yes there is at least one, on ancient hardware. IMO a viable Linux phone requires hardware at most one generation old.
While vibe coding will get you something that potentially works, I've noticed LLMs are really bad at cleanly abstracting across multiple layers in this area. They usually will insist on parsing and serializing every field at every layer.
If you have the protocols/interfaces well defined up front it is very fast at building extensions, analytics or visualizations though.
The packet tunnel story is crazy. I'm glad Android allows you to just use network APIs without question as a developer.
https://portswigger.net/burp/communitydownload
I then flip on WireGuard on my phone, pointed to mitmproxy, and seamlessly all traffic from my phone is decrypted and viewable through the website on my computer.
Except of-course all the applications these days that do certificate pinning, which is annoying, but for that we have Frida.
Burp Suite uses a subscription model. Charles a model like Sublime Text: you buy it and get to keep the version forever, major upgrades available for a discount.
I had to chuckle at this one:
> If you purchased a Charles license prior to 1 May 2008 your existing license key is still valid for Charles 5.
So I guess in past they used a model where you'd have lifetime upgrades.
Which also made me think: I recognize this name! This has to be an older piece of software. Was it published on Freshmeat in the start of this century?
There's also some TUI for Wireshark, such as frontends for tshark. I think [1] looks interesting, since it can be used with a local LLM (via Ollama).
[1] https://github.com/kspviswa/pktai
- Burp Proxy
- Wireshark, tshark
[1] without an elaborate setup, your program needs to be instructed to dump TLS encryption keys for Wireshark to read
Have mitmproxy gotten any better in usability over the years?
Just based on the images, is seems to have the same problems?
The new-ish "Local Capture" and "WireGuard"-mode are quite nice.
And running e.g. `mitmproxy --ignore-hosts '.*' --show-ignored-hosts` [1] for monitoring apps with certificate pinning also a new feature
[1] cmd will turn mitmproxy into a "non-MITM proxy" but do show domains (SNI) the app is connecting to.
https://www.telerik.com/fiddler
Dead Comment
Deleted Comment
I recently had the IT team at my work ban VNC client, they didn't understand it wasn't VNC server, which I could understand being a security risk, but the client? They're idiots.
Charles is a http proxy, Requestly judging by the landing page is a http client like Postman.
I tried using proxyman for a while, and while definitely powerful and more modern, it honestly didn't feel "better" or more powerful so I didn't go for yet another license.
This goes without saying, but huge thanks to the both developers for making these available.
Does it work for Xcode simulators?
I use Charles extensively (I am using it for the development I’m doing right now), and it needs to work on simulators.
Cost isn’t an issue for me. Fitness to purpose is important. I won’t cripple my development capacity, in order to save $50.
Not trying to do an ad, but really glad I don‘t have to think about that anymore :)
Deleted Comment
Obligatory Ten Thousand reference: https://xkcd.com/1053/
https://httptoolkit.com
It even bypasses SSL pinning on Android using 1 click.