HeaderHermit — Header Editor & API Mock

Switch HTTP request and response headers by profile, and mock JSON APIs. Makes no network requests of its own.

HeaderHermit changes HTTP headers and fakes API responses on the sites you choose — and nothing else. It makes no network requests of its own. SWITCH ENVIRONMENTS IN ONE CLICK • Keep a profile for each environment — Local Dev, Staging, Production — and switch between them from the toolbar. • The toolbar badge shows which profile is on, so a forgotten header never costs you an afternoon. ONE-CLICK PRESETS • Start a profile with a preset: Allow CORS (the CORS response headers), Bearer token (an Authorization: Bearer header), Disable cache, Custom User-Agent, or Mock a JSON API — then edit it like any rule. EDIT REQUEST AND RESPONSE HEADERS • Set, append or remove any request or response header: Authorization, Cookie, CORS, Content-Security-Policy, feature flags and more — with suggestions for common header names and values. • Every mistake is shown right at the field that has it; an empty, unfinished row is simply ignored. • Scope each profile by URL filter or regex, excluded URLs, resource type, method, request domain or initiator domain. • Rules apply in list order and the top rule wins. Mistakes are flagged next to the rule before they reach the browser. • Header rules run on Chrome's built-in rule engine (declarativeNetRequest), inside the browser. MOCK APIS THAT AREN'T READY YET • Answer a URL with the JSON (or other text) body, status code and delay you choose. • Works for the page's own fetch() and XMLHttpRequest calls. The first matching mock wins, and a profile's excluded URLs are never mocked. • Honest limits: these are not mocked — requests a page makes before its first script runs, synchronous XMLHttpRequest, requests from service workers and web workers, image/script/stylesheet/iframe loads, sendBeacon and WebSockets. Pages that were already open need a reload after you turn mocks on. Mocked calls do not appear in DevTools' Network panel, because they never reach the network. BRING YOUR PROFILES WITH YOU • Export and import all profiles as a JSON file. • Also imports ModHeader profile exports, with a clear report of anything that works differently. HeaderHermit is an independent project and is not affiliated with its makers. PRIVATE BY DESIGN • Runs only on sites you allow. Turning a profile on asks Chrome for the site you are on; "Allow on all sites" is there if you want it. Remove access any time in the settings. • No network requests of its own, no account, no analytics, no remote code. Your profiles stay on this device. • The code in the package is readable, not minified. Made by Forgeline.