Inspector

The inspector is the bottom half of the main window. It shows the request you select in the traffic list: the request on the left and the response on the right, each split into tabs for headers, body, cookies and more. Tabs that don’t apply to a request, such as GraphQL or Auth, only appear when they’re relevant.

12345

The inspector: a header bar, then the request and response side by side.

1. Method and full URL. Select the URL to copy part of it.
2. Status, duration, response size and the app that sent it
3. Copy menu
4. Request tabs, with counts
5. Response tabs

×

Layout

• Inspector size. Drag the line between the traffic list and the inspector to give either more room. Cloak Proxy remembers the position. Double-click the line to put it back to the default.
• Request and response. The request pane is on the left and the response pane on the right. Drag the divider between them to resize.
• Which request. The inspector shows the selected request. When several are selected, it shows the newest one (the highest #).
• Nothing selected. The inspector says Select a request to inspect it and reminds you that ↑ ↓ move between requests and ⌘ F filters.
• Tunnels. For an HTTPS connection that wasn’t decrypted, the inspector shows an explanation and buttons to turn on decryption instead of tabs. See Failed requests and tunnels.

The header bar

The bar across the top of the inspector summarizes the request.

Item	Shows
Method badge	The HTTP method, colored like the traffic list
URL	The full URL. It’s selectable, and long URLs are shortened in the middle (hover for all of it).
Status	For example 200 OK, colored by class. Failed in red when there’s no response, or a spinner while waiting.
Duration	How long the exchange took
Size	The response body size
App	The app’s icon and name. Hover to see its process number.
Copy menu (•••)	Copy URL, Copy as cURL, Copy Request and Copy Response

Copy Request and Copy Response copy the whole message as text: the start line, every header, a blank line and the decompressed body. When a request failed, the error appears on a second line under the bar in orange.

Tabs

Each tab with a count shows it next to its name, such as Header 4 or Cookies 2. Cloak Proxy remembers the last tab you chose in each pane and opens it for the next request. If that tab doesn’t exist for the next request (say, Auth on a request without an Authorization header), the request pane falls back to Header and the response pane to Body.

Request tabs

Tab	Appears	Shows
Header	Always	Every request header
Query	Always	The URL’s query parameters, decoded
Body	Always	The request body in the body viewer
Form	Form posts (application/x-www-form-urlencoded or multipart/form-data)	Each form field as a name and value
GraphQL	GraphQL requests	The formatted query and its variables. See WebSocket and GraphQL.
Cookies	Always	Cookies sent in the Cookie header
Auth	Requests with an Authorization header	The decoded token or credentials
Raw	Always	The request as text
Code	Always	The request as code in 20 formats
Summary	Always	Timing, sizes, protocol, TLS and the client

Response tabs

Tab	Appears	Shows
Messages	WebSocket connections	Every frame sent and received. Replaces Body.
Header	Always	Every response header
Body	Everything except WebSockets	The response body in the body viewer
Set-Cookie	Responses with Set-Cookie headers	Each cookie the server set, with its attributes
Raw	Always	The response as text

Until a response arrives, the response pane shows Waiting for the response…. If the request failed, it shows No response and the error.

Header

The Header tab lists headers in the order they were sent, with repeated headers (such as two Set-Cookie lines) kept separate.

12

Request headers as a table. Switch to Text to see them as plain lines.

1. Show headers as a table or as text
2. Copy all headers

×

• Table shows a Name and Value column. Long values wrap to up to four lines.
• Text shows the headers as Name: Value lines you can select, search with ⌘ F, and decode with Quick Preview.
• The copy button copies every header as Name: Value lines.

Your choice of Table or Text applies to both panes and is remembered.

Copy from a table

The Header, Query, Form, Cookies and Set-Cookie tabs are name and value tables. Select one or more rows, then right-click:

Item	Copies
Copy Value	The values, one per line
Copy Name	The names, one per line
Copy “Name: Value”	Both, as Name: Value lines

Query

The Query tab lists the URL’s query parameters with their values decoded. The count in the tab shows how many there are. Parameters that repeat appear once per occurrence. When there are none, it says No query parameters.

Query parameters from https://api.example.com/v1/users?page=1&limit=2&sort=name.

×

Body

The Body tab shows the request body in the same viewer as response bodies: a JSON tree, pretty and raw text, hex, form tables and more. It decompresses gzip, deflate and Brotli first. Requests without a body, like most GET requests, show No body. Everything about the viewer is on Body viewers.

Form

The Form tab appears for form posts. It shows each field as a name and a decoded value.

A URL-encoded form post, decoded into fields.

×

For multipart/form-data uploads, text fields show their value and file fields show the file name and size instead of the file’s bytes. See Form and multipart bodies.

Cookies

The request Cookies tab splits the Cookie header into one row per cookie, so session=abc123; theme=dark becomes session and theme. When the request sends none, it says No cookies.

Cookies the request sent.

×

Set-Cookie

The response Set-Cookie tab lists each cookie the server set. The value comes first, followed by the cookie’s attributes in parentheses, such as Path, HttpOnly, Secure, SameSite and Max-Age.

1

Each cookie with its attributes.

1. Attributes in parentheses

×

To check cookie flags across a whole session, use the Security page in Insights.

Auth

The Auth tab appears when the request has an Authorization header. It decodes what it can:

Header	Shows
A JSON Web Token, such as Bearer eyJ…	The token’s header and payload as formatted JSON, then when it was issued, when it becomes valid and when it expires, marked (expired) or (valid)
Basic credentials	Basic authentication and the decoded user:password
Anything else	The header as it was sent

A bearer token decoded. The signature isn't checked.

×

Caution

The Auth tab shows credentials in plain text, including decoded Basic passwords. Take care when sharing your screen or screenshots. Cloak Proxy doesn’t verify JWT signatures, so (valid) only means the expiry date hasn’t passed.

Raw

The Raw tabs show the message as text: the start line (for example GET /v1/users?page=1 HTTP/2.0 or HTTP/2.0 200 OK), every header, a blank line and the decompressed body. Binary bodies are replaced by a note pointing you to the Hex view. Bodies over 5 MB show their first 5 MB.

The request as text.

×

The response as text, body included.

×

The text is selectable. Press ⌘ F inside it to search, and right-click a selection to decode it.

Code

The Code tab turns the request into code you can run. Choose a format from the menu (it starts at cURL) and click Copy. Cloak Proxy remembers the format you picked.

12

The request as a curl command.

1. Choose one of 20 formats
2. Copy the code

×

The formats, and what each one leaves out, are on Copy as code.

Summary

The Summary tab collects the facts about the exchange in one place.

Who sent the request, how, and how big it was.

×

Row	Shows
URL	The full URL
Method	The HTTP method
Status	The status code and reason, or Waiting, Tunneled, Completed or Failed: and the error
Protocol	The request’s HTTP version, then the response’s, for example HTTP/2.0 → HTTP/2.0
TLS	Decrypted by Cloak Proxy, Passed through encrypted, or None (plain HTTP)
Client	The app’s name and process number
Executable	The path to the program that sent the request, when known. For an app, this can be a helper inside its bundle.
Client address	Where the connection came from: 127.0.0.1 for this Mac, or a device’s IP address
Remote	The server’s host and port
Started	Date and time the request started
Duration	Total time
Request size	Request body size, marked (truncated) if it was over the capture limit
Response size	Response body size, marked (truncated) if it was over the capture limit
Content type	The response’s Content-Type

Note

Bodies larger than the Max captured body size in Settings › General (32 MB by default; see Network settings) are still forwarded in full. Only the first part is kept for the inspector, and the body viewer shows a Truncated label.

Related

Body viewersJSON tree, JSONPath, jq, hex, previews and decoders.

WebSocket and GraphQLThe Messages and GraphQL tabs.

Quick PreviewDecode Base64, JWTs, URL encoding and timestamps from any text.

Copy as codecURL and 19 other formats.