Request Records

Request records show the HTTP requests that went through MeowX’s decryption engine: method, URL, status, headers, timing, which rules were applied, and optionally the bodies. They are a debugging tool and are off by default.

Where to find them

• iPhone and iPad: the Activity tab → Requests segment (on iPad, a list with the details on the right), or Me → HTTPS Decryption (MITM) → Request Records.
• Mac: the Requests page of the HTTPS Decryption window, with the list on the left and the details on the right. Use the arrow keys to move through the list and Command-F to search.

In connection details, decrypted connections offer View requests, which opens the records filtered to that host.

Turning recording on

Switch	What it records
Record Requests	Request and response headers and metadata. Kept in memory only and cleared when you disconnect.
Record Bodies	Also the request and response bodies. Bodies may contain sign-in information and personal data; they are kept in memory only, cleared when you disconnect, and never recorded for banking, payment and other sensitive hosts.

Recording needs the HTTPS Decryption switch to be on. Only requests that MeowX actually decrypts (or plain HTTP requests its rules apply to) are recorded; connections that are passed through don’t appear. If the hostname list has no hosts to decrypt yet, the page says so and offers View recently visited hosts. If the certificate isn’t trusted, only plain HTTP requests are recorded.

The list only refreshes while the page is open and MeowX is in the foreground.

What a record contains

• Time, method, URL, status code, request and response headers, sizes and duration.
• Protocol: HTTP/1.1 or HTTP/2. HTTP/2 request headers include the pseudo-headers (:method, :path …).
• The headers actually sent: request headers after rewriting (as sent upstream) and response headers after rewriting (as returned to the app).
• The rules that were applied, in order, with where they came from (module name, or “Local rules line N”).
• Local response · no upstream when the request was answered by a reject, redirect or Map Local rule.

The list can be searched by host or path and filtered with All, Local responses, Errors (status 400 or higher, or no response), Sensitive hosts, or a specific host.

Limits

	iOS	macOS
Records kept	most recent 300	most recent 300
Header size stored per record	16 KB	16 KB
Total memory, headers only	1 MB	1 MB
Total memory with bodies (headers included)	4 MB	32 MB
Body stored per direction	first 64 KB	first 256 KB
Bodies being recorded at the same time	1 MB in total	8 MB in total

When a limit is reached, the oldest records are removed first. A body larger than the per-direction limit is stored up to the limit and marked as truncated, together with its full size. If too many bodies are being recorded at once, a body may be truncated earlier or not stored at all. Turning Record Bodies off discards the bodies already recorded but keeps the records.

Sensitive hosts

For hosts that look like banking, payment, government, sign-in (SSO) or password-manager services:

• the values of Cookie, Set-Cookie and Authorization and the URL query are masked, showing only the first 4 characters (for example 8f3a••••);
• bodies are never recorded.

Records for these hosts are tagged Sensitive.

The details view

The details show a summary and two tabs, Request and Response, each with headers and body. Bodies are fetched from the tunnel only when you open a record.

• Compressed bodies (gzip, deflate, br, zstd) are recorded exactly as sent and decompressed for display. If a body was truncated, MeowX shows as much as it can decompress.
• JSON is shown indented (key order unchanged, even for truncated data), forms and text as they are, images as a preview, and other binary data as a hex dump of the first 1,024 bytes.
• Very long bodies are shortened on screen (120,000 characters on iOS, 600,000 on macOS); exports contain everything that was recorded.
• Notes explain missing bodies: truncated, sensitive host, recorded while Record Bodies was off, record already removed or tunnel reconnected, or bodies discarded.
• After a connection is upgraded to WebSocket (or becomes a tunnel), the rest of its data isn’t recorded.

Copy as cURL

Copy as cURL builds a command that repeats the request:

• The method is omitted for GET, --head is used for HEAD, and POST with a body needs no -X.
• Hop-by-hop headers and Content-Length are left out; Host is left out when it matches the URL. Accept-Encoding is kept and --compressed is added.
• HTTP/2 records drop the pseudo-headers and add --http2.
• A UTF-8 text body is passed with --data-binary. Binary, truncated or unrecorded bodies are left out, with a # comment explaining why.
• Masked values are copied as they are (with ••••), and MeowX tells you that some values are masked.

Export HAR

Export HAR saves records as an HTTP Archive (HAR 1.2) file that browsers’ developer tools and many analysis tools can open. You can export a single record from its details, or the whole current list (respecting the current filter and search). Exporting a list first fetches every record’s bodies, with progress shown and the option to cancel.

• iOS: the file (MeowX-YYYYMMDD-HHmmss.har) is handed to the share sheet.
• Mac: the file is written to your Downloads folder (a number is added if the name exists) and selected in Finder. The export continues even if you close the window.

The file contains decompressed text bodies, Base64 for binary bodies, notes for truncated or missing bodies, the protocol version of each request, and a _meowx field with the applied rules, local-response flag and masking.

Records can contain secrets

Copied cURL commands and HAR files contain request and response headers and bodies, including cookies, Authorization headers and tokens returned by sign-in requests. Values for sensitive hosts are masked, but everything else isn’t. Share them only with people you trust.