https://tracerproxy.com/teardowns/ We capture well-known apps' network traffic on a stock iPhone and publish what we find: endpoints, SDKs, payloads, and where the data goes. en-us Tue, 28 Jul 2026 00:00:00 GMT https://tracerproxy.com/guides/see-network-requests-iphone https://tracerproxy.com/guides/see-network-requests-iphone Tue, 28 Jul 2026 00:00:00 GMT Watching every request an iPhone app makes, in plaintext, on the phone itself: a root certificate you trust in Settings and a NetworkExtension proxy are the whole mechanism. iOS splits installing a certificate from trusting it, which is why most captures come back empty. Also what a single logged exchange contains, why a device-wide capture shows traffic you didn't cause, the three causes of an empty log and how to tell certificate pinning from a broken trust setup, and what proxy-based inspection can never see. https://tracerproxy.com/guides/how-network-inspection-works https://tracerproxy.com/guides/how-network-inspection-works Tue, 28 Jul 2026 00:00:00 GMT The mechanism behind reading another app's decrypted HTTPS on a stock iPhone, at the level you'd need to build one: interception starts at the CONNECT line rather than at SNI, and the leaf certificate the phone accepts is 414 bytes with no Authority Key Identifier, no CRL, no OCSP and no CT proofs. Also why the CA key lives in the Secure Enclave while the TLS server's key can't, how an app determines whether its own root is trusted when iOS offers no API for it, and the four classes of traffic a proxy-based inspector structurally cannot see. https://tracerproxy.com/guides/see-what-data-apps-send https://tracerproxy.com/guides/see-what-data-apps-send Tue, 28 Jul 2026 00:00:00 GMT Reading your own apps' outgoing traffic, using one real analytics upload as the worked example: a POST to us.i.posthog.com captured 2026-07-24, 14,640 bytes, eight events, five of them the app reporting which A/B tests it had sorted the phone into. Includes the thirteen feature-flag names it leaked, the Sentry headers that reveal an SDK making no requests of its own, a reference list of the analytics hosts worth recognizing, and what iOS's own App Privacy Report does and doesn't show. https://tracerproxy.com/guides/export-har-file-iphone https://tracerproxy.com/guides/export-har-file-iphone Tue, 28 Jul 2026 00:00:00 GMT Capturing a request on-device and walking away with a standard HAR 1.2 file — three taps, no Mac. What that file contains is the other half of the job: a single-request export taken on 2026-07-24 ran to 19,657 bytes and carried a live analytics API key in the request body, where the header-scrubbing jq line everyone runs would have missed it. Also where to open a HAR, a tested one-liner to merge several into a session, and the four ways a capture changes the numbers in the file. https://tracerproxy.com/guides/inspect-https-traffic-iphone-without-mac https://tracerproxy.com/guides/inspect-https-traffic-iphone-without-mac Mon, 27 Jul 2026 00:00:00 GMT Reading decrypted app traffic with nothing but the phone in your hand: install a certificate, trust it, capture. The VPN iOS asks you to allow doesn't carry your packets — it claims one unused benchmarking route and exists so the device will honor a proxy setting pointing at loopback. Also what a capture changes about your connections (HTTP/2 becomes HTTP/1.1, no connection reuse), how to tell certificate pinning from a broken trust setup, and why deleting the app doesn't delete the certificate authority. https://tracerproxy.com/guides/charles-proxy-iphone-alternatives https://tracerproxy.com/guides/charles-proxy-iphone-alternatives Mon, 27 Jul 2026 00:00:00 GMT Charles Proxy has shipped an iPhone app since March 2018, and it does not do the four things people open desktop Charles for: rewrite, breakpoints, Map Local and throttling. A checkable comparison of the five on-device inspectors — Charles for iOS, Proxyman for iOS, Storm Sniffer, Stream and Tracer — with versions and prices read from the App Store on 2026-07-27, the NetworkExtension architecture split that decides what each one can see, and where a Mac is still the right answer.