Hostnames

The hostname list decides which HTTPS connections MeowX decrypts. A connection is decrypted only if its hostname matches a positive entry and no exclusion that comes earlier in the list. Plain HTTP doesn’t use this list (see Overview).

Open it from Hostnames on the HTTPS Decryption page (iOS) or in the HTTPS Decryption window (Mac).

Syntax

The syntax follows Surge’s [MITM] hostname:

Entry	Matches
`api.example.com`	Exactly `api.example.com`
`*.example.com`	Any subdomain, such as `a.example.com` and `a.b.example.com`, but not `example.com` itself
`ad?.example.com`	`?` matches exactly one character: `ad1.example.com`, `adx.example.com`
`*`	Every host (see the warning below)
`-ads.example.com`	A leading `-` makes it an exclusion: never decrypt this host
`api.example.com:8443`	Only connections to port 8443
`api.example.com:0`	Any port (Stash’s `:*` is read the same way)

* matches any number of characters, including dots, and can be empty. ? matches one character.
Entries are case-insensitive; a trailing dot is ignored. Only letters, digits, -, _, . and the wildcards are allowed. Invalid entries are listed in a warning and have no effect.
Surge’s special tokens <ip-address>, <ipv4-address>, <ipv6-address> and <simple-hostname> are accepted but currently have no effect. Writing an IP address also has no effect: a connection made directly to an IP address carries no hostname for MeowX to sign a certificate for, so it is always passed through.
In modules, a list is separated by commas (full-width commas work too): hostname = %APPEND% a.example.com, *.b.example.com, -c.example.com.

Ports

Entry	When the app’s TLS handshake names the host (the usual case)	When the hostname isn’t known from the handshake
Bare `host`	Matches on any port	Port 443 only
`host:443`	Port 443 only	Port 443 only
`host:8443`	Port 8443 only	Port 8443 only
`host:0`	Any port	Any port

A bare entry matching a connection on a port other than 443 makes MeowX wait at most 300 ms for the app to start a TLS handshake. Protocols where the server speaks first (mail, games and similar) are then passed through and shown as “TLS handshake not received”. If that happens, add an explicit port such as :443 so the bare hostname doesn’t cover other ports.

Effective order

Entries are checked in this order, and the first match wins:

Your exclusions (-host), including those added with Add exclusion. They always take effect first; modules can’t override them.
Built-in exclusions: -*.apple.com, -*.icloud.com, -*.mzstatic.com, -*.push.apple.com, -apple.com, -icloud.com, -mzstatic.com. Most Apple system services use certificate pinning, so decrypting them only breaks them. You can delete them and restore them later; modules can’t delete them.
Module %INSERT% entries, in module list order.
Your hostnames (positive entries), in the order you drag them into.
Module %APPEND% entries and module entries written without an operator, in module list order.

This differs from Surge, where module settings take precedence over the configuration: in MeowX, an exclusion you add always wins.

The hostname page shows the same sections: My exclusions, Built-in exclusions, From modules · inserted first, My hostnames, and %APPEND% and override syntax. Each row shows where it comes from and its latest diagnostic result.

Disabling entries

You can disable any entry (yours, a module’s or a built-in one) without deleting it; this is the same as Surge’s hostname-disabled. A module’s own hostname-disabled line can only disable positive entries, and it disables every positive entry with the same text, including yours; such rows are marked as disabled by the module. A module can’t disable your exclusions or the built-in ones.

Module hostnames

A module’s hostname is only used if at least one of that module’s supported rules (or your local rules) could match it. Hosts that a module lists only for rules MeowX doesn’t support are not decrypted, which saves battery and avoids problems; the module’s details say how many were left out. If you want a host decrypted without any rule (for example to record its requests), add it to your own hostnames.
Surge’s override syntax (hostname = a.com, b.com without %APPEND% or %INSERT%) would replace everyone else’s hostnames. MeowX treats it as append instead and notes this in the module’s details.

Finding hosts to add

Recently visited hosts

Below the add field, Recently visited hosts lists hosts from recent connections (both open and just closed), grouped by host and port, with how often and how recently each was seen. Only domain names are listed, because connections made to bare IP addresses can’t be decrypted. DNS connections, ports 80 and 53, and UDP traffic on ports other than 443 are left out.

Each row shows its relationship to decryption, checked in this order:

Always direct: the host is your provider’s dashboard or a subscription domain, in the bypass list, or APNs. It is never decrypted.
Covered by an exclusion: the first matching entry is an exclusion (yours, a built-in one, or a module’s), and the row says which.
Already in the list, with the latest result (decrypted, or passed through and why), or “decrypting from new connections” if nothing has been decided yet.
Not in the list: only these rows get a Decrypt button.

Decrypt adds the exact hostname to My hostnames (or re-enables it if that exact entry was disabled). It takes effect for new connections. To add a wildcard instead, long-press the button (iOS) or use the arrow menu next to it (Mac) and choose Decrypt *.parent. The wildcard is only offered for names with at least three labels, and not when the parent looks like a public suffix such as co.uk or com.cn.

Hosts that look like banking, payment, government, sign-in or password-manager services are tagged Sensitive and ask for confirmation before they are added.

The list refreshes every 5 seconds while the page is open, MeowX is in the foreground and the tunnel is connected, and it is cleared when you disconnect. It shows the first 6 hosts with a button to show the rest, and it has a search field. If HTTPS decryption is off or the certificate isn’t trusted, a note explains that adding hosts won’t decrypt anything yet.

Decrypt this host

In connection details (Activity on iOS; the connection detail overlay in the Mac menu bar panel), a connection that wasn’t decrypted, whose host is a domain name that isn’t in the list, isn’t covered by an exclusion and isn’t always-direct, has a Decrypt this host button. It adds the exact hostname (long-press for the wildcard form; sensitive hosts ask first) and confirms that new connections will be decrypted. Decrypted connections instead offer View requests, which opens the request records filtered to that host.

When the hostname list has no positive entries at all, the request records page says so and offers View recently visited hosts.

Connections that are never decrypted

These are passed through regardless of the hostname list:

Your provider’s dashboard and its subscription domains, hosts in the bypass list, and APNs (unless you route APNs through the proxy). These are checked before the list; modules can’t change them.
Connections whose rule result is REJECT: they are rejected as usual.
Connections from other devices on your LAN through the local proxy.
Connections without a hostname in the TLS handshake, or where the hostname is an IP address.
Hosts that are temporarily skipped after certificate pinning was detected (1 hour) or after a server-side failure (10 minutes). You can clear these from Diagnostics.
Connections arriving while decryption is at its connection or memory limit.
Everything listed on Limits, such as TLS 1.2-only apps or servers.

The temporary skips, always-direct traffic and limits are checked separately from the list, so they can’t be changed by reordering entries.