Header Lens
Header Lens lets you set, override, append or remove HTTP request and response headers for the site you're working on — and nothing else. It ships as a popup for a quick change, a DevTools panel for real work, and a persistent side panel that docks beside the page and follows the tab you're on. Privacy-first: host access is requested per site, only when you ask, and nothing ever leaves your machine.
Why not a proxy, a curl flag, or a server change?
- A header you need on every request the browser makes — navigations, fetches, scripts, images, websockets — not just the one you crafted by hand.
- A change that survives a restart and can be paused with one switch when you're done.
- A rule that is scoped: to one site (subdomains included), to all the sites you granted, or narrowed further with a URL filter — never a blanket proxy.
Rules are installed as Chrome's declarativeNetRequest dynamic rules, so the
browser applies them itself: no blocking webRequest, no request observed or
logged.
2-minute quick start
- Open a site, click the Header Lens toolbar icon and press Grant access to this site.
- Open the Add tab. Pick a preset (Authorization, Accept-Language, Cache-Control, a mobile User-Agent…) or type a header name and value.
- Choose Request or Response, keep This site, press Create.
- Reload the page. The toolbar badge shows how many rules are active; the row's green dot says the rule applies here.
To verify a response rule, read the headers the page sees — DevTools' Network panel shows what the server sent, not what Chrome applied:
fetch(location.href, { cache: "no-store" }).then(r => console.table([...r.headers]))
What a rule is
| Field | Meaning |
|---|---|
| Header / Value | The header name and the value to set or append. Remove ignores the value. |
| Operation | Set overrides, Append adds a second value (request side: only on multi-value headers Chrome allows), Remove strips the header. |
| Target | REQ changes what the browser sends; RES changes what the page receives. |
| Applies to | One site (its registrable domain, subdomains included), all granted sites, or another site you type. |
| Only first-party requests | On by default: the rule fires for navigations and for requests the site makes to itself — not for a third-party page embedding the site's resources. Turn it off for cross-site API calls (badged Any origin). |
| URL filter | Optional declarativeNetRequest urlFilter (/api/, ||cdn.example.com^) narrowing the rule further. |
Who is it for?
- Frontend engineers testing auth, feature flags, locales and caching.
- Backend engineers verifying how a service behaves behind a header.
- QA engineers reproducing user states (languages, devices, flags).
- Anyone who needs a header on a request without touching server config.
Privacy-first by design
All processing happens locally. Header Lens never sends anything anywhere, includes no analytics or telemetry, and loads no third-party scripts. The UI only ever receives the origin of the tab, never its path or query. Rules and profiles are stored in local extension storage — they contain the header values you typed, which is why exporting credential-like values asks first.
Read the full privacy policy.