Features at a glance

#Requests

• Any HTTP method, URL bar with {{variable}} highlighting, hover tooltips and autocomplete
• Query params table synced with the URL, path variables (/users/:id), headers with bulk edit
• Bodies: raw (JSON / XML / HTML / JavaScript / text, with beautify and JSON linting), form-data with file uploads, x-www-form-urlencoded, binary file, and GraphQL with schema autocomplete, checks, an explorer, operation picking and subscriptions (GraphQL)
• Auth: inherit from parent, Basic, Bearer, API key (header or query), Digest, AWS Signature v4, and OAuth 2.0 with every common grant:
  • Authorization Code, with or without PKCE, and Implicit: sign in in an HttpDash window, which catches the redirect to any registered callback URL, or in your own browser with a callback on 127.0.0.1 (RFC 8252)
  • Client Credentials and Password
  • Refresh tokens, expiry display and "Sign Out of Providers". Tokens you get by signing in are never shared through team sync; each person keeps their own.
• Per-request settings: follow redirects, SSL verification, cookies, timeout
• WebSocket and gRPC requests (unary and every kind of streaming, from .proto files or server reflection) alongside HTTP
• Paste a cURL command into the URL bar to import it
• Tags on requests, suggested as you type, and versions: the last 50 versions you sent by hand are kept with their responses, to switch back to in a click
• Connections are kept open and reused (keep-alive), so repeat requests skip DNS, TCP and TLS

#Responses

• Status, time and size, with a breakdown of DNS / connect / TLS / first byte
• Pretty (JSON / XML / HTML formatting), Table, Raw, Preview (sandboxed HTML, images) and Visualize (pm.visualizer.set with Handlebars-style templates)
• Table view for JSON: arrays of objects become sortable tables, objects become key/value tables, and nested values open as tables in place. Filter rows as you type. Long tables are virtual (only the rows on screen are drawn), so a 100,000-row response opens in about 0.1 s and scrolls smoothly, even when the big array is nested inside another object.
• Export a table as an Excel workbook, CSV (UTF-8, opens correctly in Excel) or a PNG image, following the current filter and sort. Nested objects become dotted columns (address.city); Excel cells keep numbers and booleans typed, with a bold, frozen header.
• Search, line wrap, copy, save to file, save as example
• Large responses (over about 2 MB of text by default) show their first 512 K characters until you click Show all, so the window never freezes; Table, Visualize, Events and image previews always use the whole response
• Headers, cookies, test results with filters, and a timeline showing the request actually sent and any redirects
• Network (in the timeline): every address the host resolves to, the one it connected to in octets and segments, your network adapter, and a route trace
• Health: what the service's health endpoint said before, during and after the request, when a health URL is set
• Compare: the same request sent to every instance of a service, and the one that answered differently

Scripts (Postman-compatible pm API)

• Pre-request and test scripts on collections, folders and requests, run in Postman's order
• pm.environment / globals / collectionVariables / variables / iterationData, pm.request (headers, URL, query, body), pm.response (json(), text(), headers, code, responseTime)
• pm.test, pm.expect (Chai), pm.response.to.have.status(...) / .header(...) / .jsonBody(...) / .jsonSchema(...) / .be.success and similar
• pm.sendRequest, pm.setNextRequest, pm.cookies, pm.visualizer, pm.execution.skipRequest
• CryptoJS (MD5, SHA-1/224/256/384/512 and their HMACs, encoders), atob / btoa, Buffer, URL / URLSearchParams, TextEncoder / TextDecoder, setTimeout, console.* output in the Console panel, and legacy tests[...], postman.*, responseBody
• require for chai, crypto-js, util, url and buffer
• Every script runs in an isolated sandbox with no access to Node or your files
• Snippet library in the script editor

#Organisation

• Collections and nested folders with drag-and-drop, rename, duplicate, delete and "Copy as cURL"
• Collection / folder settings: description, auth, scripts, collection variables
• Environments (with secret values and a color that tints the top and bottom bars while active), globals, environment quick look, dynamic variables ({{$guid}}, {{$timestamp}}, {{$randomEmail}}, …)
• A sidebar search that suggests from every request's name, URL, method and tag, with chips that combine
• History grouped by day (an entry of a saved request opens that request), multiple tabs with unsaved-change tracking, all restored on restart
• Preview tabs: a single click opens a temporary tab (in italics) that the next click replaces; edit it, send it, double-click it or choose Keep open to keep it

#Collection Runner

• Run a collection or folder, and pick its requests from a tree or by tag; environment, iterations and a gap in milliseconds between requests
• 500 requests with scripts and tests in about a third of a second (npm run bench compares it with Newman and Bruno)
• CSV / JSON data files (one iteration per row), pm.setNextRequest flow control, stop on failure
• Live results with per-request tests, request/response details and exportable JSON results
• Optionally persists variable changes made during the run

#Import / export & tools

• Import HttpDash backups, Postman collections (v2.0 / v2.1), environments and globals, OpenAPI 3.0 / 3.1 and Swagger 2 (JSON or YAML) and cURL; drag files onto the window to import
• OpenAPI imports keep each operation's examples (request bodies, parameters and responses), so the collection's mock server works right away, and turn security schemes into auth settings (Bearer, Basic, API key, and OAuth 2.0 including PKCE). They follow $refs within the document (references to other files aren't followed), read OpenAPI 3.1 types, and handle large specs: GitHub's 10 MB API description imports in about a second.
• Export everything as a restorable backup or as Postman files, or export single collections, environments and globals
• Code generation: cURL, raw HTTP, JavaScript fetch, Node.js Axios, Python requests, Go, PHP cURL, C# HttpClient, Java OkHttp, PowerShell, wget
• Cookie manager (view / add / edit / delete per domain)
• Settings: timeout, redirects (and how many), SSL verification, connection reuse, cookie jar, no-cache header, HTTP proxy (including HTTPS via CONNECT, with auth and bypass list), tunnels (SSH jump hosts and SOCKS5) into internal networks, network tracing and segment size, user agent, response size limit and large-response size, history length, light / dark / system theme, zoom (70% to 130%), editor font size, stacked or side-by-side layout; plus certificates, security (app lock), AI access and data
• Console panel with network and script logs; keyboard shortcuts for sending, find, undo and redo across the whole request, and moving between tabs