Getting started
Three steps: install the app, trust its certificate once, and turn on the system proxy. After that every request your Mac makes shows up decrypted.
1. Install
Download the dmg and drag elcapture into Applications. It is signed and notarized by Apple, so it opens with a normal double-click, and it updates itself from then on.
2. Trust the certificate
To read HTTPS, elcapture decrypts it with its own certificate authority (named elcapture Root CA), created locally on first run. Click Install CA in the toolbar. macOS asks for your password and adds the certificate to your login keychain, trusted for SSL. The private key never leaves your Mac and is not in the app bundle. You can re-export, regenerate, or import your own CA from the Certificate panel.
3. Turn on the system proxy
Flip System proxy in the toolbar (⇧⌘S). elcapture points macOS at itself as the HTTP and HTTPS proxy on port 9090 and restores your old settings when you turn it off or quit. Open any app or browser and its requests appear in the list, newest at the bottom.
Read a request
Click a row to open it on the right: request and response headers, the body as a JSON tree or raw text, timing, and the TLS connection. Narrow the list with the filter bar (⌘L), for example status:4xx host:api — see Filtering. Learn the list itself in The traffic list, and the detail panels in Inspecting a request.
What is captured
HTTP, HTTPS, HTTP/2, WebSocket and gRPC, plus raw TCP and UDP. Nothing is sent anywhere: captured traffic lives on your Mac, and you can encrypt the history with a key in your Keychain. There is no account.