WebSocket & SSE Tester

About the WebSocket & SSE Tester

Test a real-time API without writing code. Enter a WebSocket address (wss://…), optionally with subprotocols such as graphql-transport-ws, connect, and send text, JSON or binary frames (typed as hex or Base64). Every frame in both directions lands in a timestamped log with its size, which you can filter by text or regular expression, pretty-print, copy and export as JSON Lines or text. Turn on auto-reconnect with exponential back-off, or a keep-alive message that is sent at a fixed interval, and close the connection with your own close code and reason.

For Server-Sent Events, use the browser’s EventSource (simple GET, optional cookies) or the fetch() mode, which can send request headers such as Authorization, use POST with a body (as many streaming AI APIs need) and shows the HTTP status, every event type, comments and retry: hints. The connection goes straight from your browser to the server: MySmartCoPilot never sees your messages or tokens.

Common uses

• Checking that a WebSocket server accepts connections, the right subprotocol and your messages before wiring up a front end.
• Debugging a chat, notification, trading or multiplayer back end by watching the raw frames.
• Testing a Server-Sent Events endpoint, including authenticated and POST-based streaming APIs.
• Reproducing a disconnect: reading the close code, testing auto-reconnect and keep-alive behaviour.
• Capturing a session as JSON Lines to attach to a bug report.

What a browser can and cannot do here

• Only secure addresses from this page. It is served over HTTPS, and browsers block insecure ws:// and http:// connections from secure pages (mixed content); the page tries wss:// / https:// instead and tells you. To test a local server, give it a TLS certificate your browser trusts (for example with mkcert) or expose it through an HTTPS tunnel.
• Origin checks and CORS. A WebSocket handshake sends this page’s Origin header, and some servers reject unknown origins. Event streams are normal HTTP requests, so the server must allow this site with CORS (Access-Control-Allow-Origin); custom headers in fetch() mode also need a preflight.
• No custom WebSocket headers. Browsers do not let pages add headers (such as Authorization) to a WebSocket handshake; servers usually take a token in the query string, a cookie, a subprotocol or the first message instead.
• No ping frames. Browsers answer the server’s ping frames automatically, but a page cannot send its own (RFC 6455 control frames are not exposed to scripts). The keep-alive sends an ordinary message of your choice, e.g. {"type":"ping"}.
• No error details. When a connection fails, browsers deliberately report only “error” and close code 1006, so the log lists the usual causes instead.

Close codes

RFC 6455 (§7.4.1) and the IANA close-code registry define the codes you will see: 1000 normal closure, 1001 going away (server restart or page left), 1002 protocol error, 1003 unsupported data, 1006 abnormal closure (no close frame — network failure, refused connection or a failed handshake; never sent by servers), 1007 invalid payload (e.g. text that is not UTF-8), 1008 policy violation, 1009 message too big, 1011 internal server error, 1012 service restart, 1013 try again later. Codes 4000–4999 are for applications to define. A page may close with 1000 or 3000–4999 only, with a reason of at most 123 bytes (WHATWG WebSockets Standard).

EventSource or fetch()?

EventSource is the browser’s built-in client: it reconnects by itself and resumes with the Last-Event-ID header, but it can only make GET requests, cannot add headers, and delivers named events (event: update) only to listeners registered for that name — list them under “Also listen for these event types”. fetch() mode reads the raw stream with the parsing rules of the HTML Standard (“Interpreting an event stream”), so it shows every event, comment line and retry: value, and it can send any method, headers and body. It reconnects only when you tick the option, sending the last event ID it saw.

Limitations

• Insecure ws:// and http:// endpoints cannot be reached from this HTTPS page (see above); use wss:// and https://.
• Other real-time protocols built on top — Socket.IO, SignalR, STOMP, MQTT over WebSocket — work only as far as you type their frames yourself; the page does not speak those protocols for you.
• The log keeps the newest 5,000 entries (and shows the newest 1,500); export earlier if you need everything from a long session.
• Messages and request headers are not saved; reloading the page ends the connection.

Privacy

The page connects directly from your browser to the address you enter — never through MySmartCoPilot. Messages, headers and tokens are not stored; only the address (without its query string) and your settings are remembered in this browser.