What a rule actually looks like
Three fields. That is the whole model — no scripting, no config file, no proxy to run.
Each row is one rule. The toggle on the right disables that rule alone; the master switch in the popup disables every rule at once while leaving them all intact.
What it does
A small tool with a narrow job, and no surprises around the edges.
Add or override headers
Set a header that is not there, or replace one the browser would otherwise send. Both are the same operation as far as a rule is concerned.
Match by URL pattern
Scope each rule to exactly the origins and paths you want, so a staging-only header never reaches production.
Per-rule toggles
Turn one rule off to check a hypothesis, then turn it back on. No editing, no re-typing, no commented-out rows.
Master switch
One control disables every rule at once — useful right before you reproduce a bug against a clean baseline. Your rules are not deleted.
Rules that follow you
Rules are stored with Chrome’s sync storage, so they survive a restart and show up on the other machines where you are signed into the same Chrome profile.
Manifest V3
Built on declarativeNetRequest, so Chrome applies the rules itself. The extension does not sit in the path of your traffic reading requests.
About the permissions
Chrome will warn you that this extension can «read and change all your data on all websites». That warning is generated from the permissions an extension requests, not from what it actually does. Here is every permission it asks for and why.
declarativeNetRequestThe API that applies your header rules. Chrome evaluates the rules internally and modifies the request itself — the extension never receives the contents of your requests.
storageSaves your rules so they persist across browser restarts and sync across your signed-in Chrome profiles. Your rules are the only thing stored.
<all_urls>This is the one that triggers the scary warning. You decide which URLs your rules match, so the set of hosts cannot be known ahead of time — the extension has to be able to act on any URL you might type into a rule. Narrowing it would mean shipping a fixed list of sites and refusing to work anywhere else.
What it does not do
- Does not read page content or the DOM.
- Does not read or record your browsing history.
- Does not collect analytics, usage data, or identifiers of any kind.
- Makes no network requests of its own and loads no remote code.
- Sends nothing to our servers or to any third party.
There is no account, no telemetry, and no opt-out to hunt for, because there is nothing to opt out of. The full breakdown is in our privacy policy. Privacy
Limits worth knowing before you install
Better you read this here than discover it halfway through debugging something.
This browser only
Rules apply to requests made by this browser. Server-to-server calls, curl, Postman, your CI runner and your backend’s outbound requests are all untouched.
Request headers only
Response headers are not modified. If you need to change what comes back, this is not the tool for it.
Some headers cannot be set
Chrome protects a number of headers from extension modification. Rules targeting those are silently dropped — no error, no warning. If a rule looks correct but has no effect, this is usually why.
Questions
The things developers ask before installing something with this permission set.
Does it collect any data about me?
No. There is no analytics, no telemetry, no identifiers, and no advertising or attribution SDKs. The extension makes no network requests of its own. The only thing it stores is the rules you create, in Chrome’s own storage.
Why does it need access to all websites?
Because you choose which URLs your rules match, the set of hosts is not knowable in advance. The permission is what lets a rule you write today apply to a URL we have never heard of. It does not read page content or browsing history.
Can it modify response headers?
No — request headers only. Modifying responses is a different capability and this extension does not have it.
Why is my rule not doing anything?
The usual cause is that Chrome protects that particular header from being set by extensions, and drops the edit silently. Otherwise, check that the URL pattern actually matches the request, that the rule’s toggle is on, and that the master switch is not off.
Does it affect requests made outside the browser?
No. Only requests made by this browser are affected. Anything server-to-server — including requests your own backend makes — goes out unchanged.
Where are my rules stored?
In chrome.storage.sync, which is Chrome’s own storage. That means they persist across restarts and sync to the other machines where you are signed into the same Chrome profile. They are never sent to us.
Add it to Chrome
Free, no account, and it collects nothing. If it turns out not to be what you need, uninstalling takes it and your rules with it.
Add to ChromeRequires Chrome or a Chromium-based browser