mitmproxy (mitmproxy.org) is a free, open-source proxy that opens up encrypted web traffic, so you can read a request, change it and send it again. One download holds three tools: a console, a browser interface called mitmweb, and mitmdump for scripts and servers. Its latest release on 12 October 2026 was 12.2.3, from 12 May. People look elsewhere when they want a desktop window, an easier phone setup, a security scanner, or JavaScript instead of Python, and the comparison is sorted by those needs.
What mitmproxy is, by the numbers
On its first start mitmproxy creates a certificate authority of its own, then makes a certificate for each site on the fly. Any program that trusts that authority sends it traffic it can decrypt. Its home page lists HTTP/1, HTTP/2, HTTP/3 and WebSockets.
The code has been on GitHub since February 2010 under the MIT licence. On 12 October 2026 the repository had 45,429 stars and 626 contributors, anonymous ones included. PyPI holds 88 releases, from 0.8 in April 2012 to 12.2.3. By the count of pypistats.org it was downloaded 3,516,981 times from PyPI in the month to 11 October, and its Docker image shows 28.9 million pulls since 2018.
Nothing sits behind a paywall. The documented features include map local and map remote, editing headers and bodies, replaying a client or a server, blocking chosen requests, sticky cookies and logins, and streaming of large bodies. Addons are plain Python files that hook into each request.
It captures traffic in nine modes. Regular is a proxy you point a browser or device at; local capture picks up programs on the same computer; WireGuard takes another device or a single Android app; reverse sits in front of a server. Transparent, TUN, upstream, SOCKS5 and DNS cover the rarer cases.
How mitmproxy changed, 2012 to 2026
Apr 2012
0.8, its first release on PyPI
Dec 2016
1.0
Dec 2020
6.0 needs Python 3.8
Oct 2022
9.0 adds WireGuard mode
other devices and single Android apps
Aug 2023
10.0 adds HTTP/3, experimental
and needs Python 3.10
Jan 2024
10.2: local redirect mode
on macOS and Windows
Oct 2024
11.0: transparent HTTP/3
Jan 2025
11.1: local capture on Linux
and Python 3.12 or newer
Oct 2025
12.2 supports Python 3.14
12 May 2026
12.2.3, the latest release
on 12 October 2026
The deep changes came in the last four years. WireGuard mode arrived in 9.0 in October 2022, experimental HTTP/3 in 10.0 in August 2023, and capture of local programs on macOS and Windows in 10.2 in January 2024. Transparent HTTP/3 followed in 11.0, and local capture reached Linux in 11.1 in January 2025.
The pace picked up as well: 13 releases in 2024 and 10 in 2025, against 2 to 9 a year before. 2026 has two so far, 12.2.2 in April and 12.2.3 in May, while work on the code went on: the last change reached GitHub on 5 October.
Why the mitmproxy you install may be years old
mitmproxy raises the Python version it needs every year or two, and each step leaves older systems behind. The changelog announces it with the same sentence each time:
pip installs the newest release that your Python allows, so Python 3.10 and 3.11 stop at 11.0.2 from December 2024. Linux distributions lag much further, and mitmproxy's installation page warns that their packages "often lag behind the current mitmproxy release".
Which mitmproxy each route installs, 12 October 2026
| Route | Version | Released |
|---|---|---|
| Ubuntu 22.04, apt | 6.0.2 | December 2020 |
| Ubuntu 24.04 and its newest series, apt | 8.1.1 | June 2022 |
| Debian testing and the previous stable release | 8.1.1 | June 2022 |
| Debian's current stable release | no package | |
| pip with Python 3.10 or 3.11 | 11.0.2 | December 2024 |
| Its binaries, Homebrew, uv or Docker | 12.2.3 | May 2026 |
Ubuntu's archive (Launchpad), Debian's archive (madison) and PyPI, read from our server on 12 October 2026
Version 8.1.1 predates WireGuard mode, HTTP/3 and local capture. mitmproxy recommends its own binaries on Linux and Windows, Homebrew on macOS, and uv for Python setups. The binaries carry their own Python and OpenSSL, frozen at release, and mitmproxy does not "phone home", so it never tells you that a newer version exists.
Why people look for an alternative
Keyword Planner counted 27,100 searches a month for "mitmproxy" worldwide on 12 October 2026, 1,600 for "mitmweb" and 1,000 for "mitmproxy android"; "mitmproxy alternative" and "mitmproxy alternatives" drew 110 each. Google's suggestions pair it with Fiddler, Wireshark, Burp Suite, Charles, Squid and Proxyman, and ask whether it is safe, free and open source.
Four reasons come up. mitmweb runs in a browser tab. Each phone and each browser has to be told to trust the certificate, and apps that pin their certificates refuse it until they are patched; mitmproxy's own documentation points to apk-mitm and objection for that. Addons are written in Python. And mitmproxy intercepts traffic; it does not scan an application for security holes.
The alternatives side by side
The prices below come from each seller's own pages, read from our server on 12 October 2026. We ran none of the tools, so the comparison covers price, licence and what each is built for.
mitmproxy's alternatives by what you need, 12 October 2026
| You want | Tool | Price or licence |
|---|---|---|
| An open-source desktop app | HTTP Toolkit | free Hobbyist plan; Professional by subscription |
| A paid desktop app | Charles | $50 a licence |
| A paid desktop app | Proxyman | $89 for one device |
| A paid desktop app | Fiddler Everywhere | from $7 a month, billed yearly |
| A desktop app with a free tier | Reqable | Community free; Premium $49.90 a year |
| Security testing | Burp Suite | Community free; Professional $499 |
| Security testing | ZAP | free, Apache-2.0 |
| Security testing | Caido | Basic free for 2 projects |
| JavaScript, not Python | Whistle | free, MIT |
Each tool's price, download and licence pages, and GitHub records, read from our server on 12 October 2026
HTTP Toolkit
HTTP Toolkit is the nearest thing to mitmproxy with a window. Its desktop app, server and interface are published under AGPL-3.0, and the free Hobbyist plan intercepts supported clients automatically, shows the raw traffic and lets you rewrite a request at a breakpoint. Professional adds automatic mock and rewrite rules, import and export of traffic, and settings such as TLS passthrough, client certificates and upstream proxies, all free in mitmproxy. Its price loads from a payment service in the browser, so we give no figure.
The engine underneath is mockttp, a TypeScript library under Apache-2.0 that, by HTTP Toolkit's own account, powers all of its internals. npm counted 2,243,986 downloads of it in the month to 10 October, which makes it a natural route for people who want mitmproxy's kind of scripting in JavaScript.
Burp Suite, ZAP and Caido
These three are built for security testing: around the same kind of proxy, they add tools for finding holes in an application. Burp Suite's Community Edition is free and Professional costs $499. ZAP is free under Apache-2.0, calls itself "the world's most widely used web app scanner", and released 2.17.0 in December 2025; its download page warns that the releases are "currently unsigned".
Caido keeps its releases in a GitHub repository opened in October 2021, and version 0.58.3 came out on 4 September 2026. Its Basic plan is "Free forever" for 2 projects and 7 workflows; Individual, Team and Enterprise are paid, at prices its page fetches from a payment service rather than prints.
Charles, Proxyman, Fiddler and Reqable
These are desktop debugging apps, priced in detail on our Proxyman alternatives page. Charles sells one licence for $50. Proxyman asks $89 for one device, and its free version limits the debugging tools to one rule and leaves out map local, map remote, breakpoints and scripting, which mitmproxy gives away. Fiddler Everywhere starts at $7 a user a month on a yearly bill, Fiddler Classic stays free for non-commercial use on Windows, and Reqable pairs a free Community edition with Premium at $49.90 a year.
Proxyman's own "best mitmproxy alternative" page says mitmproxy has "No GUI interface" and that everything goes "through terminal commands". mitmproxy's home page describes mitmweb as exactly that interface.
Whistle
Whistle is the Node.js counterpart: a debugging proxy for HTTP, HTTP/2, HTTPS and WebSocket under the MIT licence. It has 15,725 stars on GitHub and 621 versions on npm since March 2015, the latest published on 11 October 2026, and npm counted 19,070 downloads in the month to 10 October.
Wireshark and selenium-wire
Wireshark answers a different question. It captures and analyses packets, live or from a saved file, while mitmproxy holds a request so you can change it, and mitmproxy's documentation has a how-to for using the two together on TLS traffic. selenium-wire, a Python library for reading a Selenium browser's requests, is archived on GitHub after a last change in January 2024, and its readme says it "is no longer being maintained".
Where HProxy fits
mitmproxy can hand everything it captures to a second proxy. Upstream mode forwards every request, and the upstream_auth option supplies the login:
mitmweb --mode upstream:http://host:port --set upstream_auth=username:password
A scraper's traffic can then be read in mitmweb while it leaves from a residential address, so you see the page a site serves to a home connection. In HTTP Toolkit the same upstream setting is a Professional feature.
An HProxy residential endpoint is a host and port with a login, which is all upstream mode asks for. Lite, with country targeting, costs $0.50/GB at the smallest size; Premium can target a state, a city or an ISP from $1.49, keeps one address for up to 24 hours, and its balance never expires. Our guide to proxies for web scraping covers the setup.
Which one to pick
- Stay with mitmproxy for scripted interception, servers without a screen, WireGuard or local capture, and anything you want to automate in Python.
- For a window and open code: HTTP Toolkit.
- For a polished paid app: Charles at $50, Proxyman at $89, or Fiddler Everywhere by subscription.
- For security testing: ZAP at no cost, Burp Suite Professional or Caido when you need their paid tools.
- For Node.js: Whistle, or mockttp inside your own code.
- The one to retire: selenium-wire, unmaintained by its own readme.
What we could not find out
We ran none of these tools, so speed, memory use and the handling of pinned apps are not compared. HTTP Toolkit and Caido load their paid prices from a payment service in the browser, so no figure appears for them. Download counts include automated builds, which inflate PyPI and npm numbers alike. Every version, price and package listed here is due for a fresh reading by 12 January 2027.
Sources
- mitmproxy: home page, installation, certificates, features, getting started, proxy modes and options documentation, and CHANGELOG.md on GitHub, read 12 October 2026.
- mitmproxy's release history on PyPI, pypistats.org, Docker Hub and the GitHub API, 12 October 2026.
- Ubuntu's archive through Launchpad and Debian's archive through madison, 12 October 2026.
- HTTP Toolkit, Burp Suite, ZAP, Caido, Charles, Proxyman, Fiddler and Reqable: price, download and licence pages, read 12 October 2026; npm for Whistle and mockttp.
- GitHub records of ZAP, Whistle, Caido, HTTP Toolkit, Wireshark and selenium-wire, 12 October 2026.
- Proxyman's "best mitmproxy alternative" page and its two comparison posts of July 2026, read 12 October 2026.
- Search volumes from Keyword Planner (worldwide) and the suggestions Google sent our server, 12 October 2026.
- HProxy's prices: the live price tokens of our site and its product pages, as they stood when this page was written.
