Testnizer covers the full enterprise API surface — REST, SOAP, gRPC, GraphQL, WebSocket, SSE, Socket.IO and MCP, plus an AI client and a complete security workbench: keystores, certificates, JWT/JOSE, JWK/JWKS, SAML and TLS inspection. The work that usually means keytool, openssl, jwt.io and a folder of scripts happens here, offline. None of it phones home.
Protocols
Mock Server
Define endpoints with path params, wildcards, or regex. Pick a response with declarative conditions on headers, query, body (JSONPath/XPath), or method. Sign and encrypt the responses with templating, in-memory state, and a Node-vm sandbox that runs your JavaScript before each reply. Plus auth, schema validation, failure injection, rate limit, CORS, OpenAPI/Postman import, and a recording proxy — all on 127.0.0.1.
Built-in tools
These all run inside Testnizer's main process, with no network call. If your machine is offline, they still work.
Decode, sign and verify in one tool: HS / RS / PS / ES signatures, JWE encrypt/decrypt, claim editing with human-readable expiry, and verification against a JWKS. Sign with a shared secret, a PEM key, or an alias from your keystore — in that last case the private key stays in the app core and never reaches the editor.
Open, create, edit, convert and export JKS / PKCS#12 keystores and X.509 certificates — without keytool or openssl. Generate key pairs and secret keys, import five formats, manage aliases and both password levels, export entries as PEM / DER / PKCS#12. Key↔certificate match is checked cryptographically, not by name.
PEM ⇄ JWK both ways, key-pair generation, RFC 7638 thumbprints as kid, JWK-Set assembly — and serving a JWKS from a mock server at /.well-known/jwks.json so a service under test can fetch your keys. Public keys only, enforced at the boundary.
Assemble an AuthnRequest / Assertion / Response, sign it with enveloped XML-DSig, and validate one — including the Redirect and POST bindings. The validator proves WHICH element was signed, so XML Signature Wrapping, algorithm confusion (HMAC keyed with your trusted certificate), SHA-1, XXE and expired bearer windows are rejected with the exact reason.
Point it at a live endpoint and read back the certificate chain, expiry, protocol versions and negotiated ciphers — the same TLS settings your requests use.
Pretty-print, minify, validate. Multi-line input, syntax errors with line numbers. Sort-keys / sort-attributes options.
Base64, URL, Hex, HTML entities, Unicode escape — paired text fields, instant convert.
Side-by-side aligned diff with character-level intra-line highlights for paired modified rows. Per-side line counts and additions / removals tally; ignore-whitespace and ignore-case toggles.
Infer a draft-07 JSON Schema from a sample document, including string-format detection (date, date-time, email, uuid, uri, ipv4) and array-shape unions via oneOf.
Live-evaluate expressions against an in-editor sample. Built-in canonical sample datasets and 11–17 ready-to-load example queries each (Goessner reference + common predicates).
Both directions with attribute preservation, xsi:nil → null mapping, paths-as-arrays hint, ignore-nulls / ignore-empty filters, root-element naming.
XSLT 1.0 transformations + Jolt-compatible JSON shaping (shift / default / remove). 17 Jolt + 8 XSLT runnable samples bundled.
Apply, verify, decrypt, and sign arbitrary XML. Same engine as the SOAP request panel. Useful for inspecting captured envelopes.
MD5, SHA-1, SHA-256, SHA-384, SHA-512 — all algorithms computed in parallel for the same input, with per-row copy buttons. RFC-vector tested.
HMAC-SHA1 / SHA256 / SHA384 / SHA512 with shared secret. RFC 4231 vector tested.
Auto-detected unit (seconds / ms / μs / ns) ↔ ISO 8601 + GMT + local zone + relative ("4 seconds ago"). Date-parts builder for the inverse direction.
Searchable, category-filtered reference (1xx / 2xx / 3xx / 4xx / 5xx) covering 60+ codes from RFC 9110 + IANA + WebDAV.
ASCII ↔ Binary ↔ Octal ↔ Decimal ↔ Hex — UTF-8 byte-aware, all five fields synced live, multi-byte characters handled correctly.
v1 / v4 / v5 / v7 in batches up to 1000, with namespace presets (DNS / URL / OID / X.500) for deterministic v5. Lower / upper / no-dashes / urn / braces formats. Validate + version-detect any UUID.
Live regex match with named + numbered group captures, replacement preview with $1 backreferences, all six JS flags toggleable, and a built-in cheatsheet (email / URL / IPv4 / UUID / ISO 8601 / JWT / hex color / phone).
Bidirectional with indent + sort-keys options. JSON_SCHEMA-safe (no `!!js/*` tags). Convenient for OpenAPI specs, Kubernetes configs, and Helm charts.
Local cert store, mTLS / client certificates per project, OS keychain encryption for passphrases. A client certificate can also come straight from a saved keystore alias.
pm.jose.sign / verify / decode (plus require("jose")) inside pre-request and Tests scripts, so a token can be minted in one step of a flow and used by the next. Identical on Send and in the Collection Runner.
Workflow
Sequential or parallel execution of multiple endpoints with HTML report output. Iterate over data files for parameterised runs.
Multi-collection regression sets with auto-detected import (Testnizer + Postman + Insomnia formats).
Local cron-style scheduling for repeat runs against staging or QA endpoints. No background SaaS workers.
Project files commit through your existing repo. Branch with the project, review through PRs.
Virtualised log timeline with per-tab filtering, raw request / response capture, search.
Export any request as cURL, JavaScript fetch, Python requests — useful for sharing without sharing tokens.
Free. No account, no waitlist, no telemetry.
