Free tool · runs in your browser
HTTP Evidence Diff
Powered by HTTP Semantics (IETF), Fetch Headers (WHATWG)
Raw HTTP requests or responses. Known secrets are masked before comparison and export.
Normalised changes
| Area | Key | Before | After |
|---|
Sanitised messages used for the diff
Before
After
How do you compare two pieces of HTTP evidence?
An HTTP comparison separates the start line, headers and body to identify meaningful changes between two exchanges. Excluding volatile fields such as Date or a request identifier helps distinguish a functional change from telemetry noise.
Comparing HTTP headers and bodies
The diff normalises header names, preserves repeated values and compares the start line, headers and body separately. The default option only excludes telemetry fields that normally change between two exchanges.
An export designed for evidence
The Markdown includes the change table and both sanitised messages. Code fences adapt to the content and table cells escape HTML so controlled text cannot become active markup.
?Frequently asked questions
Are requests or responses sent anywhere?
No. Both messages are parsed and compared locally; they are never replayed.
Why ignore some headers?
Dates, request identifiers and traces often change on every response. Ignoring them helps isolate functional differences.
Does the report contain original secrets?
Messages are sanitised before diffing and before Markdown generation. Human review is still required.
+More tools
- HTTPHTTP Security Inspector
Review a raw request or response, its headers, cookies and ambiguities.
- [•••]Evidence Sanitizer
Mask secrets, emails and IPv4 addresses before sharing evidence.
- 9.8CVSS Calculator
CVSS 4.0 and 3.1: score, vector and severity, live.
Technical assessment
Request an application or infrastructure assessment
For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.