How to Capture iOS HTTPS Traffic Without Jailbreak
To capture iOS HTTPS traffic without a jailbreak, Trace Eagle gives you three methods on an iPhone or iPad connected by cable: system-level capture shows the HTTPS requests the system sends with zero configuration, NIC capture records all of the device’s traffic, and app-layer capture reads one app’s complete plaintext, body included. All three work on iOS 17 and later. Re-signing an app with a development certificate is only needed when you want that app’s plaintext body.
Do I need to jailbreak my iPhone to capture traffic?
Section titled “Do I need to jailbreak my iPhone to capture traffic?”No. All three methods are built for non-jailbroken devices. You only need to connect:
- Connect the device: use a data cable to connect the iPhone / iPad to the computer, then tap Trust on the device.
- Compatible with new systems: newer versions of iOS (including iOS 17 and above) switched to a new device channel, and connecting and capturing still work here.
- If the same device also appears on the network, choose the USB / network entry accordingly.
Which of the three iOS capture methods should I use?
Section titled “Which of the three iOS capture methods should I use?”| Your need | Which to use | What you can see | Certificate install / re-sign needed? |
|---|---|---|---|
| Quickly see which HTTPS requests the system sent (address / status / headers) | System-level capture | Works for ordinary apps too (ordinary apps cannot see the body) | Neither; only a diagnostic profile |
| All traffic for the whole device (including non-HTTP, handshake / SNI) | NIC capture | Full data (ciphertext by default, decryptable on demand) | Not needed to view ciphertext; re-signing needed only to decrypt a given app |
| A given app’s complete plaintext exchanges (including the body) | App-layer capture | Complete plaintext for a single app | The target app must be re-signed with a development certificate |
None of the three require a jailbreak. System-level capture is especially hassle-free: even for ordinary apps and App Store apps you can see which HTTPS addresses they request, something many tools cannot do on a non-jailbroken iPhone.
Can I see an iPhone’s HTTPS requests without installing a certificate?
Section titled “Can I see an iPhone’s HTTPS requests without installing a certificate?”Yes, with system-level capture. It lists the HTTP(S) transactions the system sends: request method, full URL (the address is plaintext even for HTTPS), status code, request headers and response headers. No CA certificate to install, no proxy to set up, no certificate pinning to deal with.
Prerequisite: install the matching device diagnostic profile (once is enough).
How much you can see is limited by the system diagnostic logs themselves:
- Ordinary apps and App Store apps: usually only the request address and request headers.
- Apps signed with a development certificate: the full request / response body.
NIC capture: see everything on the device
Section titled “NIC capture: see everything on the device”Capture all of the device’s network traffic, regardless of app or protocol, including non-HTTP QUIC and custom protocols.
- What you see by default: ciphertext packets + metadata (target address, port, and the SNI hostname from the TLS handshake), enough to see “which places this device connected to and with what protocol.”
- Want plaintext: use “Decrypt this program” on the target app; this requires the app to have been re-signed with a development certificate.
App-layer capture: complete plaintext for a single app
Section titled “App-layer capture: complete plaintext for a single app”Targeting a single app, this method obtains the complete plaintext (including the body) it sends and receives. SSL pinning cannot stop it, because it reads from inside the app.
Prerequisite: the target app must be re-signed with a development certificate; App Store apps and system apps must be re-signed before they can be targets. Only re-signed apps are selectable in the app list; the rest are grayed out.
- Restart the target program: close and relaunch the app to capture its early-startup traffic too.
- Turn on “socket traffic” as a fallback: for apps that statically link / use a custom library and from which the usual methods cannot obtain plaintext, this switch takes a lower-level path to the data.
Can an iPhone use proxy capture?
Section titled “Can an iPhone use proxy capture?”Yes. Besides the three methods above, an iPhone / iPad can use proxy capture: point the device’s Wi-Fi proxy at this machine, install the root certificate, and you can capture HTTPS plaintext just like on a computer, with the full set of rewriting and replay capabilities. It suits apps that go through the system proxy, or rule-based rewriting / replay of mobile requests.
- Install the certificate: scan the QR code on the phone for one-tap installation → install the capture certificate
- Capture and rewriting capabilities: → Proxy Capture
- If an app loses its connection as soon as the proxy is on, bypass SSL pinning first, then decrypt through the proxy.
Which iOS method fits which scenario?
Section titled “Which iOS method fits which scenario?”- To quickly investigate “which endpoints an app requested and what they returned,” system-level capture is the easiest, and even ordinary apps work.
- To see all traffic on the whole device (including non-HTTP), use NIC capture.
- If you can re-sign the target app and want its complete plaintext body, use app-layer capture.
- To view and edit at the same time (rewrite / replay mobile requests), use proxy capture.
- If the problem is in an in-app H5 page itself, use the web inspector.
Can I capture the body of an App Store app?
Section titled “Can I capture the body of an App Store app?”System-level capture usually shows only the request address and headers. For the full body, re-sign the app with a development certificate first, then use app-layer capture or “Decrypt this program” in NIC capture.
Does capture still work on iOS 17?
Section titled “Does capture still work on iOS 17?”Yes. iOS 17 and later use a new device channel, and Trace Eagle still connects and captures normally.
What does system-level capture require?
Section titled “What does system-level capture require?”Only a one-time install of the matching device diagnostic profile. No CA certificate and no proxy.
Can NIC capture see QUIC traffic?
Section titled “Can NIC capture see QUIC traffic?”Yes. NIC capture records all of the device’s traffic, including non-HTTP QUIC and custom protocols, shown by default as ciphertext plus metadata (address, port, SNI).
Back to Proxy Capture · Related: Android capture · Data Viewing and Decoding · Certificate Management and Installation