A desktop HTTP and HTTPS proxy for macOS, Windows, and Ubuntu. It lets developers, QA engineers, and testing specialists inspect and modify network traffic from their own browsers, mobile apps, and devices.

The Base tier is free with no time limit, but limited in functionality. You can start using it right away, no account needed. The Pro subscription lifts all limits; it needs an account.

Does it work with HTTPS?

Yes, by installing a local root certificate for decryption. Fully optional — you choose what to decrypt, and can remove the certificate any time.

The proxy runs locally on your machine: captured data stays on your device and is not sent to external servers. HTTPS is decrypted only after you install a local certificate yourself. You remain responsible for whose traffic you debug.

What must Solpuga not be used for?

It is a tool for debugging your own systems. It must not be used to intercept the traffic of third parties without their consent, to bypass protection on services that are not yours, to covertly monitor other people’s devices, or to reach resources restricted by the law of the Russian Federation.

Anyone with lawful access to the system whose traffic they're debugging: a regular user on their own machine, an employee within company policy, or a contractor under agreement.

Can I use it with iOS / Android devices?

Yes. Point the device's Wi-Fi proxy setting to the proxy address, then install and trust the Solpuga certificate. Android also supports proxying over USB.

What protocols does it support?

HTTP/1.1, HTTPS, Server-Sent Events (SSE), and WebSocket — plaintext or encrypted, with full visibility into headers, bodies, and timing. Streaming responses show event by event as they arrive, without waiting for the connection to close.

Migrating from Charles Proxy

A map of Charles's tools onto Solpuga's and how to carry a recorded session over as HAR: what travels, what is lost, and the limits.

What maps to what

Charles puts everything under Tools; Solpuga has some of it under Tools and some in the request list itself. Where there is no equivalent, the cell is a dash.

Charles	Solpuga
Map Local	Map Local
Breakpoints	Breakpoints
SSL Proxying exclusions	Exclusion list
Client Process	Originating application
Export Session → HAR	HAR 1.2 export
Import Session → HAR	HAR import, read-only
The host tree	Grouping by host and application
Filter	Search and filters
Timing	Per-phase timing
WebSocket	Partly: messages recorded, none sent
Map Remote	—
Rewrite	—
Throttling	—
Repeat, Repeat Advanced, Compose	—
DNS Spoofing, Mirror, Auto Save, Block List	—
HTTP/2	—
Scripting	—

Carrying sessions over as HAR

Charles's own .chlz is readable by nothing else, so HAR is the route: Charles has exported it since 3.6, and Solpuga opens it.

In Charles. File → Export Session… → format HTTP Archive (.har) → save. For part of a recording: select the requests and File → Export Selected Session….

In Solpuga. Tools → import HAR (Cmd/Ctrl + Shift + I), or open the .har from your file manager. It opens in a separate read-only window with its own list and inspector, so a live capture is untouched — you can read somebody else's session without stopping your own.

One limit: files over 500 MB are refused. A day-long Charles session passes that easily, so export a selection rather than everything.

What comes across

Request and response headers, bodies, statuses and timings — everything HAR 1.2 describes. The imported window uses the same inspector as a live capture: JSON folds into a tree, images show their dimensions, binary shows as hex. Bodies and raw messages can be saved to files.

What is lost

These are limits of the format, not of anybody's implementation:

Rules. Map Local, Rewrite, breakpoints and filters are not in HAR at all — the format describes traffic, not settings. Rules have to be recreated, and the fastest way is from a captured request: the rule is filled in with the response that actually arrived.
WebSocket. HAR has nowhere to put it.
Binary request bodies. Solpuga leaves them out of its own export and flags them with a comment; other exporters have size limits of their own.
Unfinished requests. Solpuga's export omits them, and failed ones go out with status 0.
Double decompression. Bodies in Solpuga's HAR are decrypted and decompressed, while the response headers are kept as they arrived. An importer that believes Content-Encoding will try to decompress a second time. Text opening as garbage is this, not a broken file.

What you get instead

An interface in English and Russian, and a free tier with no time limit.

Download for free