Skip to content
sieve logo: a disc with seven round holessieve logo: a disc with seven round holessieve

See every request your app makes.

sieve is a debug proxy for Android and iOS, written in Rust. It runs on your Mac, decrypts HTTPS with its own root CA, and lists every request in a live web UI. You can inspect a debug app on an emulator, Simulator, or phone without changing its code.

Read the install guideView the source on GitHub
After installing, run
sieve start
Then open http://localhost:8731

Pre-alpha. Features are covered by automated tests, but device setup has not yet been verified end to end on real hardware.

The sieve web UI. A table of requests with method, host, path, status, size, and duration on the left. On the right, a JSON response from httpbin.org is open as an expandable tree.
The web UI: live requests on the left, one JSON response open on the right. Select the image to open it full size.

One command per device

Setup is automated where the platform allows it. Each command routes the device through sieve, and restores the device's settings when the session ends.

Device setup guide
  • Android, no rootsieve android setup
  • Android emulator or rootedsieve android inject-ca
  • Android app that ignores the proxysieve android vpn
  • iOS Simulator (macOS)sieve ios-sim setup
  • iPhone on the same Wi-Fisieve ios-device setup

What you can do with the traffic

Read it

HTTP/1.1, HTTP/2, and WebSocket traffic shows up in a live table that you can filter. gzip, br, and zstd bodies are decoded for display, and JSON opens as an expandable tree.

  • Copy any request as a curl command
  • Export the session as HAR
  • Tunnel hosts you don't want to see with --passthrough

Change it

Rules rewrite headers, body, or status, mock a response, map a remote host, add a delay, or block a request. Breakpoints pause a request so you can edit it in the UI. Rhai scripts handle the cases rules can't.

Rules and scripts

Get past pinning

On Android, sieve android frida spawns your app with a certificate-pinning bypass attached. For apps you own or are authorized to test.

Certificate pinning

Who it helps

Mobile developers

See what a debug build sends and receives, on an emulator, a Simulator, or a phone on your desk.

Backend developers

Check what the client really sends. Map a host or mock a response to try an API change before it ships.

QA

Reproduce an error by forcing a status, body, or delay, then export the session as HAR for the bug report.

It puts things back

sieve saves your proxy settings before it changes them and restores them when the session ends, including on Ctrl+C. If a session crashes, one command restores them.

sieve doctor --restore

Use sieve only on apps and devices you own or are authorized to test. Anyone with the CA private key can read the HTTPS traffic of devices that trust it. Responsible use

Install sieve

Download a prebuilt binary, or build it from source with Rust and Node.js.

Read the install guideDownload from Releases